Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Memory leak in parser.c:827 and 845 #200

Open
5hadowblad3 opened this issue Aug 24, 2020 · 0 comments
Open

Memory leak in parser.c:827 and 845 #200

5hadowblad3 opened this issue Aug 24, 2020 · 0 comments

Comments

@5hadowblad3
Copy link

5hadowblad3 commented Aug 24, 2020

Hi there.

It seems there are potential memory leak in parserSWF_MORPHFILLSTYLES (parser.c:827) and parseSWF_SHAPE (parser.c:845) on the newest master branch 04aee52.
image
The memory allocated for FillSystyles is not freed after the program ends.
A similar issue happens in the function parseSWF_SHAPE.

These allocation sizes are accessible for the user and thus may lead to a huge amount of memory leak in frequent file transformation on the server.

This is the demo example and the traces reproducible on the master branch.

==85905==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 50616 byte(s) in 1 object(s) allocated from:
    #0 0x7ffa5f1537fa in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x987fa)
    #1 0x458476 in parseSWF_MORPHFILLSTYLES ../../util/parser.c:827

Direct leak of 192 byte(s) in 2 object(s) allocated from:
    #0 0x7ffa5f1537fa in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x987fa)
    #1 0x458b59 in parseSWF_SHAPE ../../util/parser.c:845

Direct leak of 121 byte(s) in 6 object(s) allocated from:
    #0 0x7ffa5f153662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0x48d62d in readBytes ../../util/read.c:252

Direct leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x7ffa5f153662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0x458167 in parseSWF_MORPHLINESTYLES ../../util/parser.c:755

SUMMARY: AddressSanitizer: 50930 byte(s) leaked in 10 allocation(s).

Reproduce command:

swftophp poc

POC:
parserSWF_MORPHFILLSTYLES_leaks.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant