Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR_DECR() in decompiler.c file that causes a direct segmentation fault and leads to denial of service.
Hi, there.

There is a segmentation fault in the newest master branch 04aee52.
Here is the reproducing command:
~~~~
swftophp poc
~~~~

POC:
[seg-decompile1640.zip](https://github.com/libming/libming/files/5123144/seg-decompile1640.zip)


Here is the reproduce trace reported by ASAN:
~~~~
==79767==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x00000042782c bp 0x0000000000f0 sp 0x7ffdbd64ccf0 T0)
    #0 0x42782b in decompileINCR_DECR ../../util/decompile.c:1640
    #1 0x44e234 in decompileActions ../../util/decompile.c:3535
    #2 0x44e234 in decompile5Action ../../util/decompile.c:3558
    #3 0x4114d9 in outputSWF_INITACTION ../../util/outputscript.c:1860
    #4 0x402836 in readMovie ../../util/main.c:281
    #5 0x402836 in main ../../util/main.c:354
    #6 0x7fd557eb582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../../util/decompile.c:1640 decompileINCR_DECR
==79767==ABORTING
~~~~


The cause might due to the incomplete check related to the index for array regs.
<img width="1122" alt="image" src="https://user-images.githubusercontent.com/7632714/91164248-59745080-e701-11ea-8158-6cdf378decd9.png">


Segmentation fault in function decompileINCR_DECR, decompile.c 1640
This is a GitHub Issue
repo:libming
owner:libming
Title : Segmentation fault in function decompileINCR_DECR, decompile.c 1640
Issue date:

--- start body ---
Hi, there.

There is a segmentation fault in the newest master branch 04aee52.
Here is the reproducing command:
~~~~
swftophp poc
~~~~

POC:
[seg-decompile1640.zip](https://github.com/libming/libming/files/5123144/seg-decompile1640.zip)


Here is the reproduce trace reported by ASAN:
~~~~
==79767==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x00000042782c bp 0x0000000000f0 sp 0x7ffdbd64ccf0 T0)
    #0 0x42782b in decompileINCR_DECR ../../util/decompile.c:1640
    #1 0x44e234 in decompileActions ../../util/decompile.c:3535
    #2 0x44e234 in decompile5Action ../../util/decompile.c:3558
    #3 0x4114d9 in outputSWF_INITACTION ../../util/outputscript.c:1860
    #4 0x402836 in readMovie ../../util/main.c:281
    #5 0x402836 in main ../../util/main.c:354
    #6 0x7fd557eb582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../../util/decompile.c:1640 decompileINCR_DECR
==79767==ABORTING
~~~~


The cause might due to the incomplete check related to the index for array regs.
<img width="1122" alt="image" src="https://user-images.githubusercontent.com/7632714/91164248-59745080-e701-11ea-8158-6cdf378decd9.png">


--- end body ---

A segmentation fault in the decompileINCR_DECR function of libming can lead to a Denial of Service (DoS) when processing certain SWF files. The issue arises from an incomplete check related to the index for the array 'regs', which can result in accessing invalid memory addresses.