makeswf heap use-after-free

[randomssr]

makeswf heap use-after-free

There is a heap use-after-free bug in the makeswf

Test Environment

Ubuntu 20.04, 64 bit
libming(master, 04aee52)

How to trigger

1. Compile the program with AddressSanitizer
2. Run command $ ./makeswf -v 4 POC

Details

ASAN report

$ ./makeswf  -v 4 POC
WARNING: SWF compression was unsupported until version 6, use -c -1 to disable.
Output file name: out.swf
Output compression level: 9
Output SWF version: 4
Preprocessing out/default/crashes/id:000020,sig:06,src:000116+000222,time:10814561,execs:205785,op:splice,rep:16... out/default/crashes/id:000020,sig:06,src:000116+000222,time:10814561,execs:205785,op:splice,rep:16:3:6: warning: null character(s) ignored
    3 | 
        � --
             �� �OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO��|m�
      |      ^
done.
Compiling `out.swf.frame0.pp'... Unrecognized character: �
Unrecognized character: �
Unrecognized character: �
Unrecognized character: �
Unrecognized character: �
Unrecognized character: �
Unrecognized character: |
=================================================================
==1015093==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000000040 at pc 0x7fc0689fcf8e bp 0x7ffc0527a390 sp 0x7ffc0527a388
READ of size 1 at 0x60c000000040 thread T0
    #0 0x7fc0689fcf8d in bufferWriteData /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:208:20
    #1 0x7fc0689fd12e in bufferWriteBuffer /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:219:10
    #2 0x7fc068a17e87 in swf4parse /home/root/libming/sourcecode/libming/src/actioncompiler/./swf4compiler.y:945:5
    #3 0x7fc068a65ca7 in SWFAction_compile /home/root/libming/sourcecode/libming/src/blocks/action.c:133:17
    #4 0x4dfbfc in makeswf_compile_source /home/root/libming/sourcecode/libming/util/makeswf_utils.c:132:6
    #5 0x4dce26 in main /home/root/libming/sourcecode/libming/util/makeswf.c:412:9
    #6 0x7fc068637082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #7 0x41d62d in _start (/home/root/libming/fuzz/makeswf_c_v_input/makeswf+0x41d62d)

0x60c000000040 is located 0 bytes inside of 128-byte region [0x60c000000040,0x60c0000000c0)
freed by thread T0 here:
    #0 0x4a0166 in __interceptor_realloc /local/mnt/workspace/bcain_clang_hu-bcain-lv_22036/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3
    #1 0x7fc0689fcaaf in bufferCheckSize /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:180:43
    #2 0x7fc0689fcf32 in bufferWriteData /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:205:2
    #3 0x7fc0689fd12e in bufferWriteBuffer /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:219:10
    #4 0x7fc068a17e87 in swf4parse /home/root/libming/sourcecode/libming/src/actioncompiler/./swf4compiler.y:945:5
    #5 0x7fc068a65ca7 in SWFAction_compile /home/root/libming/sourcecode/libming/src/blocks/action.c:133:17
    #6 0x4dfbfc in makeswf_compile_source /home/root/libming/sourcecode/libming/util/makeswf_utils.c:132:6
    #7 0x4dce26 in main /home/root/libming/sourcecode/libming/util/makeswf.c:412:9
    #8 0x7fc068637082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x49fd3e in __interceptor_malloc /local/mnt/workspace/bcain_clang_hu-bcain-lv_22036/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x7fc0689fc631 in newBuffer /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:148:23
    #2 0x7fc068a1768f in swf4parse /home/root/libming/sourcecode/libming/src/actioncompiler/./swf4compiler.y:913:36
    #3 0x7fc068a65ca7 in SWFAction_compile /home/root/libming/sourcecode/libming/src/blocks/action.c:133:17
    #4 0x4dfbfc in makeswf_compile_source /home/root/libming/sourcecode/libming/util/makeswf_utils.c:132:6
    #5 0x4dce26 in main /home/root/libming/sourcecode/libming/util/makeswf.c:412:9
    #6 0x7fc068637082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/root/libming/sourcecode/libming/src/actioncompiler/compile.c:208:20 in bufferWriteData
Shadow bytes around the buggy address:
  0x0c187fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fff8000: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd
  0x0c187fff8010: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1015093==ABORTING

PoC