Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

memory leak in parseSWF_SHAPEWITHSTYLE #71

Open
bestshow opened this issue Jun 7, 2017 · 4 comments
Open

memory leak in parseSWF_SHAPEWITHSTYLE #71

bestshow opened this issue Jun 7, 2017 · 4 comments

Comments

@bestshow
Copy link

bestshow commented Jun 7, 2017

On libming latest version, a memory leak was found in function parseSWF_SHAPEWITHSTYLE.

#listswf $FILE

Direct leak of 576 byte(s) in 1 object(s) allocated from:
    #0 0x4e004d in realloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x5bf458 in parseSWF_SHAPEWITHSTYLE /home/haojun/Downloads/libming-master/util/parser.c:882:49
    #2 0x5d7315 in parseSWF_DEFINESHAPE3 /home/haojun/Downloads/libming-master/util/parser.c:2259:3

Direct leak of 410 byte(s) in 1 object(s) allocated from:
    #0 0x4e004d in realloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x543350 in cws2fws /home/haojun/Downloads/libming-master/util/main.c:111:15
    #2 0x5444c6 in readMovieHeader /home/haojun/Downloads/libming-master/util/main.c:198:18
    #3 0x5444c6 in main /home/haojun/Downloads/libming-master/util/main.c:346
    #4 0x7f8b1e9e3b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274

Direct leak of 384 byte(s) in 1 object(s) allocated from:
    #0 0x4dfc96 in malloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0x5431b3 in cws2fws /home/haojun/Downloads/libming-master/util/main.c:101:13
    #2 0x5444c6 in readMovieHeader /home/haojun/Downloads/libming-master/util/main.c:198:18
    #3 0x5444c6 in main /home/haojun/Downloads/libming-master/util/main.c:346
    #4 0x7f8b1e9e3b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274

Direct leak of 307 byte(s) in 1 object(s) allocated from:
    #0 0x4dfc96 in malloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0x5efe10 in readBytes /home/haojun/Downloads/libming-master/util/read.c:228:17

Direct leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x4dfe4d in calloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x5bf205 in parseSWF_FILLSTYLEARRAY /home/haojun/Downloads/libming-master/util/parser.c:620:23
    #2 0x5bf205 in parseSWF_SHAPEWITHSTYLE /home/haojun/Downloads/libming-master/util/parser.c:867
    #3 0x5d7315 in parseSWF_DEFINESHAPE3 /home/haojun/Downloads/libming-master/util/parser.c:2259:3

Direct leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x4dfc96 in malloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0x5f004f in readString /home/haojun/Downloads/libming-master/util/read.c:243:17

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x4e004d in realloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x5d7f66 in parseSWF_DEFINESPRITE /home/haojun/Downloads/libming-master/util/parser.c:2312:5

Direct leak of 6 byte(s) in 1 object(s) allocated from:
    #0 0x4e004d in realloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x5d7eae in parseSWF_DEFINESPRITE /home/haojun/Downloads/libming-master/util/parser.c:2310:5

Direct leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x4dfc96 in malloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0x5b9a1a in parseSWF_LINESTYLEARRAY /home/haojun/Downloads/libming-master/util/parser.c:684:25

Indirect leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x4dfe4d in calloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x5dae99 in parseSWF_END /home/haojun/Downloads/libming-master/util/parser.c:2469:3

Indirect leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x4dfe4d in calloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x5e1279 in parseSWF_SHOWFRAME /home/haojun/Downloads/libming-master/util/parser.c:2813:3

Indirect leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x4dfe4d in calloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x5ddab4 in parseSWF_PLACEOBJECT2 /home/haojun/Downloads/libming-master/util/parser.c:2633:3

3020 byte(s) leaked in 12 allocation(s).

testcase : https://github.com/bestshow/p0cs/blob/master/memory-leak-in_parseSWF_SHAPEWITHSTYLE
Credit : ADLab of Venustech

@strk
Copy link
Member

strk commented Jun 7, 2017 via email

@bestshow
Copy link
Author

bestshow commented Jun 7, 2017

@strk Ok,thanks.

@rathann
Copy link

rathann commented Feb 25, 2019

This is CVE-2017-11705 .

@rathann
Copy link

rathann commented Oct 3, 2019

Any plans to fix this one? It's still reproducible with current master HEAD. @hlef ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants