Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Buffer overwrite in dcputchar, decompile.c:116 #207

Open
5hadowblad3 opened this issue Aug 26, 2020 · 0 comments
Open

Buffer overwrite in dcputchar, decompile.c:116 #207

5hadowblad3 opened this issue Aug 26, 2020 · 0 comments

Comments

@5hadowblad3
Copy link

Hi, there.

There is a buffer overflow in the newest master branch 04aee52 which make the memory writable for the adversary.
Here is the reproducing command:

swftophp poc

POC:
overflow-decompile116.zip

Here is the reproduce trace reported by ASAN:

==56940==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x632000014800 at pc 0x000000423d2c bp 0x7ffd3178c6a0 sp 0x7ffd3178c690
 WRITE of size 1 at 0x632000014800 thread T0
     #0 0x423d2b in dcputchar ../../util/decompile.c:116
     #1 0x44664d in decompileIF ../../util/decompile.c:2701
     #2 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #3 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #4 0x446c9c in decompileActions ../../util/decompile.c:3535
     #5 0x446c9c in decompileIF ../../util/decompile.c:2699
     #6 0x446c9c in decompileActions ../../util/decompile.c:3535
     #7 0x446c9c in decompileIF ../../util/decompile.c:2699
     #8 0x446c9c in decompileActions ../../util/decompile.c:3535
     #9 0x446c9c in decompileIF ../../util/decompile.c:2699
     #10 0x446c9c in decompileActions ../../util/decompile.c:3535
     #11 0x446c9c in decompileIF ../../util/decompile.c:2699
     #12 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #13 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #14 0x446c9c in decompileActions ../../util/decompile.c:3535
     #15 0x446c9c in decompileIF ../../util/decompile.c:2699
     #16 0x446c9c in decompileActions ../../util/decompile.c:3535
     #17 0x446c9c in decompileIF ../../util/decompile.c:2699
     #18 0x446c9c in decompileActions ../../util/decompile.c:3535
     #19 0x446c9c in decompileIF ../../util/decompile.c:2699
     #20 0x446c9c in decompileActions ../../util/decompile.c:3535
     #21 0x446c9c in decompileIF ../../util/decompile.c:2699
     #22 0x446c9c in decompileActions ../../util/decompile.c:3535
     #23 0x446c9c in decompileIF ../../util/decompile.c:2699
     #24 0x446c9c in decompileActions ../../util/decompile.c:3535
     #25 0x446c9c in decompileIF ../../util/decompile.c:2699
     #26 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #27 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #28 0x446c9c in decompileActions ../../util/decompile.c:3535
     #29 0x446c9c in decompileIF ../../util/decompile.c:2699
     #30 0x43c38b in decompileActions ../../util/decompile.c:3535
     #31 0x432fd3 in decompileWITH ../../util/decompile.c:2728
     #32 0x432fd3 in decompileAction ../../util/decompile.c:3379
     #33 0x446c9c in decompileActions ../../util/decompile.c:3535
     #34 0x446c9c in decompileIF ../../util/decompile.c:2699
     #35 0x446c9c in decompileActions ../../util/decompile.c:3535
     #36 0x446c9c in decompileIF ../../util/decompile.c:2699
     #37 0x446c9c in decompileActions ../../util/decompile.c:3535
     #38 0x446c9c in decompileIF ../../util/decompile.c:2699
     #39 0x446c9c in decompileActions ../../util/decompile.c:3535
     #40 0x446c9c in decompileIF ../../util/decompile.c:2699
     #41 0x446c9c in decompileActions ../../util/decompile.c:3535
     #42 0x446c9c in decompileIF ../../util/decompile.c:2699
     #43 0x446c9c in decompileActions ../../util/decompile.c:3535
     #44 0x446c9c in decompileIF ../../util/decompile.c:2699
     #45 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #46 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #47 0x446c9c in decompileActions ../../util/decompile.c:3535
     #48 0x446c9c in decompileIF ../../util/decompile.c:2699
     #49 0x43c38b in decompileActions ../../util/decompile.c:3535
     #50 0x432fd3 in decompileWITH ../../util/decompile.c:2728
     #51 0x432fd3 in decompileAction ../../util/decompile.c:3379
     #52 0x446c9c in decompileActions ../../util/decompile.c:3535
     #53 0x446c9c in decompileIF ../../util/decompile.c:2699
     #54 0x446c9c in decompileActions ../../util/decompile.c:3535
     #55 0x446c9c in decompileIF ../../util/decompile.c:2699
     #56 0x446c9c in decompileActions ../../util/decompile.c:3535
     #57 0x446c9c in decompileIF ../../util/decompile.c:2699
     #58 0x446c9c in decompileActions ../../util/decompile.c:3535
     #59 0x446c9c in decompileIF ../../util/decompile.c:2699
     #60 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #61 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #62 0x446c9c in decompileActions ../../util/decompile.c:3535
     #63 0x446c9c in decompileIF ../../util/decompile.c:2699
     #64 0x446c9c in decompileActions ../../util/decompile.c:3535
     #65 0x446c9c in decompileIF ../../util/decompile.c:2699
     #66 0x446c9c in decompileActions ../../util/decompile.c:3535
     #67 0x446c9c in decompileIF ../../util/decompile.c:2699
     #68 0x446c9c in decompileActions ../../util/decompile.c:3535
     #69 0x446c9c in decompileIF ../../util/decompile.c:2699
     #70 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #71 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #72 0x446c9c in decompileActions ../../util/decompile.c:3535
     #73 0x446c9c in decompileIF ../../util/decompile.c:2699
     #74 0x446c9c in decompileActions ../../util/decompile.c:3535
     #75 0x446c9c in decompileIF ../../util/decompile.c:2699
     #76 0x446c9c in decompileActions ../../util/decompile.c:3535
     #77 0x446c9c in decompileIF ../../util/decompile.c:2699
     #78 0x446c9c in decompileActions ../../util/decompile.c:3535
     #79 0x446c9c in decompileIF ../../util/decompile.c:2699
     #80 0x446c9c in decompileActions ../../util/decompile.c:3535
     #81 0x446c9c in decompileIF ../../util/decompile.c:2699
     #82 0x446c9c in decompileActions ../../util/decompile.c:3535
     #83 0x446c9c in decompileIF ../../util/decompile.c:2699
     #84 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #85 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #86 0x446c9c in decompileActions ../../util/decompile.c:3535
     #87 0x446c9c in decompileIF ../../util/decompile.c:2699
     #88 0x446c9c in decompileActions ../../util/decompile.c:3535
     #89 0x446c9c in decompileIF ../../util/decompile.c:2699
     #90 0x446c9c in decompileActions ../../util/decompile.c:3535
     #91 0x446c9c in decompileIF ../../util/decompile.c:2699
     #92 0x446c9c in decompileActions ../../util/decompile.c:3535
     #93 0x446c9c in decompileIF ../../util/decompile.c:2699
     #94 0x446c9c in decompileActions ../../util/decompile.c:3535
     #95 0x446c9c in decompileIF ../../util/decompile.c:2699
     #96 0x446c9c in decompileActions ../../util/decompile.c:3535
     #97 0x446c9c in decompileIF ../../util/decompile.c:2699
     #98 0x44e234 in decompileActions ../../util/decompile.c:3535
     #99 0x44e234 in decompile5Action ../../util/decompile.c:3558
     #100 0x411304 in outputSWF_DOACTION ../../util/outputscript.c:1551
     #101 0x402836 in readMovie ../../util/main.c:281
     #102 0x402836 in main ../../util/main.c:354
     #103 0x7f3d2247882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
     #104 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)
 
 0x632000014800 is located 0 bytes to the right of 81920-byte region [0x632000000800,0x632000014800)
 allocated by thread T0 here:
     #0 0x7f3d22ddd9c1 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989c1)
     #1 0x423b60 in dcchkstr ../../util/decompile.c:93
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow ../../util/decompile.c:116 dcputchar
 Shadow bytes around the buggy address:
   0x0c647fffa8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c647fffa900:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Heap right redzone:      fb
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack partial redzone:   f4
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
 ==56940==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@5hadowblad3