Heap buffer overflow in decompileIF

[Radon10043]

Hi, I found a heap buffer overflow problem.
version: 0.4.8
command: swftophp poc
poc:
decompile.c_2296_41.tar.gz

Here is the report from ASAN:

header indicates a filesize of 761 but filesize is 227
<?php
$m = new SWFMovie(1);

ming_setscale(1.0);
$m->setRate(3.011719);
$m->setDimension(-8261, 1914);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(771);
Failed to find branch target!!!
Looking for: 15198

 Stream out of sync after parse of blocktype 12 (SWF_DOACTION). 61 but expecting 60.

/* SWF_DOACTION */
=================================================================
==68291==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000060 at pc 0x000000537360 bp 0x7ffda154fe70 sp 0x7ffda154fe68
READ of size 1 at 0x602000000060 thread T0
    #0 0x53735f in decompileIF /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:2296:41
    #1 0x52c277 in decompileAction /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3242:10
    #2 0x545f60 in decompileActions /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3401:6
    #3 0x545b66 in decompile5Action /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3423:2
    #4 0x51f261 in outputSWF_DOACTION /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:1548:29
    #5 0x51c3c9 in outputBlock /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:2079:4
    #6 0x52855e in readMovie /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:277:4
    #7 0x526bbc in main /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:350:2
    #8 0x7f1351eb983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #9 0x419ed8 in _start (/home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/swftophp+0x419ed8)

Address 0x602000000060 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:2296:41 in decompileIF
Shadow bytes around the buggy address:
  0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa 01 fa fa fa fa fa fa fa fa fa[fa]fa fa fa
  0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==68291==ABORTING