```
==23011==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000002108 at pc 0x00000050688f bp 0x7ffebf2a5830 sp 0x7ffebf2a5828
READ of size 8 at 0x616000002108 thread T0
    #0 0x50688e in decompile_SWITCH /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2015:37
    #1 0x500a8d in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2500:6
    #2 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #3 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #4 0x50119a in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #5 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x5010f2 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2549:5
    #8 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #11 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #12 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #13 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #14 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #15 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #16 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #17 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #18 0x7f904662bc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #19 0x41cce9 in _start (/home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/swftophp+0x41cce9)

0x616000002108 is located 8 bytes to the right of 640-byte region [0x616000001e80,0x616000002100)
allocated by thread T0 here:
    #0 0x4ad518 in calloc /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:154
    #1 0x5009c5 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2493:38
    #2 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #3 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #4 0x50119a in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #5 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x5010f2 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2549:5
    #8 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #11 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #12 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #13 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #14 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #15 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #16 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #17 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #18 0x7f904662bc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2015:37 in decompile_SWITCH
Shadow bytes around the buggy address:
  0x0c2c7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff83f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c7fff8420: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==23011==ABORTING
```
[poc-12.zip](https://github.com/libming/libming/files/12116223/poc-12.zip)

heap-buffer-overflow in decompile_SWITCH
This is a GitHub Issue
repo:libming
owner:libming
Title : heap-buffer-overflow in decompile_SWITCH
Issue date:

--- start body ---
```
==23011==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000002108 at pc 0x00000050688f bp 0x7ffebf2a5830 sp 0x7ffebf2a5828
READ of size 8 at 0x616000002108 thread T0
    #0 0x50688e in decompile_SWITCH /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2015:37
    #1 0x500a8d in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2500:6
    #2 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #3 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #4 0x50119a in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #5 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x5010f2 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2549:5
    #8 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #11 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #12 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #13 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #14 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #15 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #16 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #17 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #18 0x7f904662bc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #19 0x41cce9 in _start (/home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/swftophp+0x41cce9)

0x616000002108 is located 8 bytes to the right of 640-byte region [0x616000001e80,0x616000002100)
allocated by thread T0 here:
    #0 0x4ad518 in calloc /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:154
    #1 0x5009c5 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2493:38
    #2 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #3 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #4 0x50119a in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #5 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x5010f2 in decompileIF /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2549:5
    #8 0x4fd2c9 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3242:10
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #11 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #12 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #13 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #14 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #15 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #16 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #17 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #18 0x7f904662bc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2015:37 in decompile_SWITCH
Shadow bytes around the buggy address:
  0x0c2c7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff83f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c7fff8420: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==23011==ABORTING
```
[poc-12.zip](https://github.com/libming/libming/files/12116223/poc-12.zip)

--- end body ---

A heap-buffer-overflow vulnerability in the decompile_SWITCH function of libming allows attackers to exploit memory corruption issues, potentially leading to arbitrary code execution or application crashes. This vulnerability is triggered when the function attempts to read beyond the allocated memory bounds, as indicated by the AddressSanitizer error report.