buffer overwrite in deputs, decompile.c:105

[5hadowblad3]

Hi, there.

There is a buffer write in the newest master branch 04aee52 which could cause a denial of service or arbitrary code execution.
Here is the reproducing command:

swftophp poc

POC (unzip first):
overwrite-decompile105.zip
Here is the reproduce trace reported by ASAN:

==140076==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63200002c800 at pc 0x7f5c6dfd00ae bp 0x7ffd02c57a60 sp 0x7ffd02c57208
 WRITE of size 6 at 0x63200002c800 thread T0
     #0 0x7f5c6dfd00ad in strcat (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x730ad)
     #1 0x423bef in strcat /usr/include/x86_64-linux-gnu/bits/string3.h:148
     #2 0x423bef in dcputs ../../util/decompile.c:105
     #3 0x423ee9 in dcprintf ../../util/decompile.c:130
     #4 0x42420c in println ../../util/decompile.c:220
     #5 0x445274 in decompileIF ../../util/decompile.c:2648
     #6 0x44abeb in decompileActions ../../util/decompile.c:3535
     #7 0x44abeb in decompile_SWITCH ../../util/decompile.c:2278
     #8 0x44abeb in decompileIF ../../util/decompile.c:2637
     #9 0x44abeb in decompileActions ../../util/decompile.c:3535
     #10 0x44abeb in decompile_SWITCH ../../util/decompile.c:2278
     #11 0x44abeb in decompileIF ../../util/decompile.c:2637
     #12 0x44abeb in decompileActions ../../util/decompile.c:3535
     #13 0x44abeb in decompile_SWITCH ../../util/decompile.c:2278
     #14 0x44abeb in decompileIF ../../util/decompile.c:2637
     #15 0x44abeb in decompileActions ../../util/decompile.c:3535
     #16 0x44abeb in decompile_SWITCH ../../util/decompile.c:2278
     #17 0x44abeb in decompileIF ../../util/decompile.c:2637
     #18 0x446c9c in decompileActions ../../util/decompile.c:3535
     #19 0x446c9c in decompileIF ../../util/decompile.c:2699
     #20 0x446c9c in decompileActions ../../util/decompile.c:3535
     #21 0x446c9c in decompileIF ../../util/decompile.c:2699
     #22 0x446c9c in decompileActions ../../util/decompile.c:3535
     #23 0x446c9c in decompileIF ../../util/decompile.c:2699
     #24 0x44abeb in decompileActions ../../util/decompile.c:3535
     #25 0x44abeb in decompile_SWITCH ../../util/decompile.c:2278
     #26 0x44abeb in decompileIF ../../util/decompile.c:2637
     #27 0x446c9c in decompileActions ../../util/decompile.c:3535
     #28 0x446c9c in decompileIF ../../util/decompile.c:2699
     #29 0x44e234 in decompileActions ../../util/decompile.c:3535
     #30 0x44e234 in decompile5Action ../../util/decompile.c:3558
     #31 0x411304 in outputSWF_DOACTION ../../util/outputscript.c:1551
     #32 0x402836 in readMovie ../../util/main.c:281
     #33 0x402836 in main ../../util/main.c:354
     #34 0x7f5c6d69082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
     #35 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)
 
 0x63200002c800 is located 0 bytes to the right of 81920-byte region [0x632000018800,0x63200002c800)
 allocated by thread T0 here:
     #0 0x7f5c6dff59c1 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989c1)
     #1 0x423b60 in dcchkstr ../../util/decompile.c:93
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strcat
 Shadow bytes around the buggy address:
   0x0c647fffd8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffd8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffd8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffd8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffd8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c647fffd900:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffd910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffd920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffd930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffd940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffd950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Heap right redzone:      fb
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack partial redzone:   f4
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
 ==140076==ABORTING

[5hadowblad3]

Oh, issue #192 may be related with this issue, but its detail reported is not relevant.