Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Null pointer reference in newVAR_N #230

Open
Radon10043 opened this issue Oct 3, 2021 · 0 comments
Open

Null pointer reference in newVAR_N #230

Radon10043 opened this issue Oct 3, 2021 · 0 comments

Comments

@Radon10043
Copy link

Radon10043 commented Oct 3, 2021

Hi, I found a null pointer reference problem.
version: 0.4.8
command: swftophp poc
poc:
decompile.c_642_11.tar.gz

Here is the report from ASAN:

header indicates a filesize of 761 but filesize is 162
<?php
$m = new SWFMovie(1);

ming_setscale(1.0);
$m->setRate(128.000000);
$m->setDimension(-18499, 3460);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(771);

/* SWF_DOACTION */
ASAN:DEADLYSIGNAL
=================================================================
==68218==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fc2cb4407c6 bp 0x7ffd3db3ca40 sp 0x7ffd3db3c1c8 T0)
==68218==The signal is caused by a READ memory access.
==68218==Hint: address points to the zero page.
    #0 0x7fc2cb4407c5 in strlen (/lib/x86_64-linux-gnu/libc.so.6+0x8b7c5)
    #1 0x43e89c in __interceptor_strlen.part.31 /home/radon/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:282
    #2 0x54a3b2 in newVar_N /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:642:11
    #3 0x540218 in decompileCALLMETHOD /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:2843:9
    #4 0x52c507 in decompileAction /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3267:10
    #5 0x545f60 in decompileActions /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3401:6
    #6 0x544319 in decompileSETTARGET /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3076:3
    #7 0x52ce49 in decompileAction /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3372:10
    #8 0x545f60 in decompileActions /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3401:6
    #9 0x545b66 in decompile5Action /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3423:2
    #10 0x51f261 in outputSWF_DOACTION /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:1548:29
    #11 0x51c3c9 in outputBlock /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:2079:4
    #12 0x52855e in readMovie /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:277:4
    #13 0x526bbc in main /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:350:2
    #14 0x7fc2cb3d583f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #15 0x419ed8 in _start (/home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/swftophp+0x419ed8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x8b7c5) in strlen
==68218==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant