Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV in decompileJUMP #234

Open
Radon10043 opened this issue Oct 3, 2021 · 0 comments
Open

SEGV in decompileJUMP #234

Radon10043 opened this issue Oct 3, 2021 · 0 comments

Comments

@Radon10043
Copy link

Hi, I found a problem in decompile.c.
version: 0.4.8
command: swftophp poc
poc:
decompile.c_1843_9.tar.gz

Here is the report from ASAN:

header indicates a filesize of 62935 but filesize is 384
<?php
$m = new SWFMovie(8);

ming_setscale(1.0);
$m->setRate(96.402344);
$m->setDimension(-11975, 1300);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(24544);
skipping 0 bytes

/* SWF_FREECHARACTER */
/*Unknown block type 1017*/
/*Unknown block type 845*/
/*Unknown block type 217*/
/*Unknown block type 378*/
Failed to find branch target!!!
Looking for: 15177

Failed to find branch target!!!
Looking for: 15196

 Stream out of sync after parse of blocktype 12 (SWF_DOACTION). 238 but expecting 237.

/* SWF_DOACTION */
ASAN:DEADLYSIGNAL
=================================================================
==68313==ERROR: AddressSanitizer: SEGV on unknown address 0x601fffffffe0 (pc 0x00000053475b bp 0x7fffd8016df0 sp 0x7fffd8016b90 T0)
==68313==The signal is caused by a READ memory access.
    #0 0x53475a in decompileJUMP /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:1843:9
    #1 0x52c192 in decompileAction /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3232:10
    #2 0x545f60 in decompileActions /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3401:6
    #3 0x545b66 in decompile5Action /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:3423:2
    #4 0x51f261 in outputSWF_DOACTION /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:1548:29
    #5 0x51c3c9 in outputBlock /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/outputscript.c:2079:4
    #6 0x52855e in readMovie /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:277:4
    #7 0x526bbc in main /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/main.c:350:2
    #8 0x7f100c04083f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #9 0x419ed8 in _start (/home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/swftophp+0x419ed8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/radon/Documents/project/libming/libming-0_4_8/obj-asan/util/../../util/decompile.c:1843:9 in decompileJUMP
==68313==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant