version: 0.48
command: swftophp $PoC

PoC:
[level-2-double-36-g71.txt](https://github.com/libming/libming/files/6020324/level-2-double-36-g71.txt)


Valgrind log:
root@ubuntu:swftophp# valgrind swftophp error_level/level-2-double-36-g71.txt
==25547== Memcheck, a memory error detector
==25547== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==25547== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==25547== Command: swftophp error_level/level-2-double-36-g71.txt
==25547==
header indicates a filesize of 1685350299 but filesize is 152

\<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(101.464844);
$m->setDimension(-20257, -5744);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(14080);
skipping 1986684415 bytes
==25547== Invalid write of size 1
==25547==    at 0x8064D04: readBytes (read.c:231)
==25547==    by 0x805C894: parseSWF_DEFINEBITSPTR (parser.c:1518)
==25547==    by 0x804E462: blockParse (blocktypes.c:145)
==25547==    by 0x805FB54: parseSWF_DEFINESPRITE (parser.c:2316)
==25547==    by 0x804E462: blockParse (blocktypes.c:145)
==25547==    by 0x804E065: readMovie (main.c:265)
==25547==    by 0x804E370: main (main.c:350)
==25547==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
.. 

Asan log:
root@ubuntu:swftophp# /root/test/libming-ming-0_4_8/util/swftophp error_level/level-2-double-36-g71.txt
header indicates a filesize of 1685350299 but filesize is 152
\<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(101.464844);
$m->setDimension(-20257, -5744);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(14080);
skipping 1986684415 bytes
==25915== ERROR: AddressSanitizer failed to allocate 0x766a9000 (1986695168) bytes of LargeMmapAllocator: Cannot allocate memory
==25915== Process memory map follows:
	0x08048000-0x0809d000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x0809d000-0x0809e000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x0809e000-0x080a3000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x080a3000-0x080a5000	[heap]
	0x1ffff000-0x24000000
	0x24000000-0x28000000
	0x28000000-0x40000000
	0xb5a00000-0xb5b00000
	0xb5c00000-0xb5d00000
	0xb5e00000-0xb5f00000
	0xb6000000-0xb6100000
	0xb6200000-0xb6300000
	0xb6400000-0xb6500000
	0xb65e6000-0xb65ff000
	0xb65ff000-0xb669a000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669a000-0xb669e000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669e000-0xb669f000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669f000-0xb66a0000
	0xb66a0000-0xb66c6000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c6000-0xb66c7000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c7000-0xb66c8000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c8000-0xb66e4000	/lib/i386-linux-gnu/libgcc_s.so.1
	0xb66e4000-0xb66e5000	/lib/i386-linux-gnu/libgcc_s.so.1
	0xb66e5000-0xb66e8000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66e8000-0xb66e9000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66e9000-0xb66ea000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66ea000-0xb6702000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6702000-0xb6703000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6703000-0xb6704000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6704000-0xb6706000
	0xb6706000-0xb68b1000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b1000-0xb68b3000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b3000-0xb68b4000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b4000-0xb68b8000
	0xb68b8000-0xb698a000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698a000-0xb698b000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698b000-0xb698c000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698c000-0xb6993000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb6993000-0xb6996000
	0xb6996000-0xb69ae000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69ae000-0xb69af000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69af000-0xb69b0000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69b0000-0xb69f4000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f4000-0xb69f5000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f5000-0xb69f6000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f6000-0xb6a22000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a22000-0xb6a23000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a23000-0xb6a24000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a24000-0xb7fd7000
	0xb7fd7000-0xb7fdd000
	0xb7fdd000-0xb7fde000	[vdso]
	0xb7fde000-0xb7ffe000	/lib/i386-linux-gnu/ld-2.19.so
	0xb7ffe000-0xb7fff000	/lib/i386-linux-gnu/ld-2.19.so
	0xb7fff000-0xb8000000	/lib/i386-linux-gnu/ld-2.19.so
	0xbffdf000-0xc0000000	[stack]
==25915== End of process memory map.
==25915== AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:70 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
    #0 0xb6a084b2 (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x124b2)
    #1 0xb6a110dc (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1b0dc)
    #2 0xb6a14093 (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1e093)
    #3 0xb69fe2ed (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x82ed)
    #4 0xb6a0c88b (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1688b)
    #5 0x807f235 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x807f235)
    #6 0x806cd76 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x806cd76)
    #7 0x8054402 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8054402)
    #8 0x8074000 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8074000)
    #9 0x8054402 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8054402)
    #10 0x80497d7 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x80497d7)
    #11 0xb671faf2 (/lib/i386-linux-gnu/libc-2.19.so+0x19af2)
    #12 0x804a01f (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x804a01f)


Memory allocation failure in readBytes(read.c:231)
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory allocation failure in readBytes(read.c:231)
Issue date:

--- start body ---
version: 0.48
command: swftophp $PoC

PoC:
[level-2-double-36-g71.txt](https://github.com/libming/libming/files/6020324/level-2-double-36-g71.txt)


Valgrind log:
root@ubuntu:swftophp# valgrind swftophp error_level/level-2-double-36-g71.txt
==25547== Memcheck, a memory error detector
==25547== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==25547== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==25547== Command: swftophp error_level/level-2-double-36-g71.txt
==25547==
header indicates a filesize of 1685350299 but filesize is 152

\<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(101.464844);
$m->setDimension(-20257, -5744);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(14080);
skipping 1986684415 bytes
==25547== Invalid write of size 1
==25547==    at 0x8064D04: readBytes (read.c:231)
==25547==    by 0x805C894: parseSWF_DEFINEBITSPTR (parser.c:1518)
==25547==    by 0x804E462: blockParse (blocktypes.c:145)
==25547==    by 0x805FB54: parseSWF_DEFINESPRITE (parser.c:2316)
==25547==    by 0x804E462: blockParse (blocktypes.c:145)
==25547==    by 0x804E065: readMovie (main.c:265)
==25547==    by 0x804E370: main (main.c:350)
==25547==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
.. 

Asan log:
root@ubuntu:swftophp# /root/test/libming-ming-0_4_8/util/swftophp error_level/level-2-double-36-g71.txt
header indicates a filesize of 1685350299 but filesize is 152
\<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(101.464844);
$m->setDimension(-20257, -5744);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(14080);
skipping 1986684415 bytes
==25915== ERROR: AddressSanitizer failed to allocate 0x766a9000 (1986695168) bytes of LargeMmapAllocator: Cannot allocate memory
==25915== Process memory map follows:
	0x08048000-0x0809d000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x0809d000-0x0809e000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x0809e000-0x080a3000	/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp
	0x080a3000-0x080a5000	[heap]
	0x1ffff000-0x24000000
	0x24000000-0x28000000
	0x28000000-0x40000000
	0xb5a00000-0xb5b00000
	0xb5c00000-0xb5d00000
	0xb5e00000-0xb5f00000
	0xb6000000-0xb6100000
	0xb6200000-0xb6300000
	0xb6400000-0xb6500000
	0xb65e6000-0xb65ff000
	0xb65ff000-0xb669a000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669a000-0xb669e000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669e000-0xb669f000	/usr/lib/i386-linux-gnu/libfreetype.so.6.11.1
	0xb669f000-0xb66a0000
	0xb66a0000-0xb66c6000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c6000-0xb66c7000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c7000-0xb66c8000	/lib/i386-linux-gnu/libpng12.so.0.50.0
	0xb66c8000-0xb66e4000	/lib/i386-linux-gnu/libgcc_s.so.1
	0xb66e4000-0xb66e5000	/lib/i386-linux-gnu/libgcc_s.so.1
	0xb66e5000-0xb66e8000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66e8000-0xb66e9000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66e9000-0xb66ea000	/lib/i386-linux-gnu/libdl-2.19.so
	0xb66ea000-0xb6702000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6702000-0xb6703000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6703000-0xb6704000	/lib/i386-linux-gnu/libpthread-2.19.so
	0xb6704000-0xb6706000
	0xb6706000-0xb68b1000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b1000-0xb68b3000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b3000-0xb68b4000	/lib/i386-linux-gnu/libc-2.19.so
	0xb68b4000-0xb68b8000
	0xb68b8000-0xb698a000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698a000-0xb698b000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698b000-0xb698c000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb698c000-0xb6993000	/root/test/libming-ming-0_4_8/src/.libs/libming.so.1.4.7
	0xb6993000-0xb6996000
	0xb6996000-0xb69ae000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69ae000-0xb69af000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69af000-0xb69b0000	/lib/i386-linux-gnu/libz.so.1.2.8
	0xb69b0000-0xb69f4000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f4000-0xb69f5000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f5000-0xb69f6000	/lib/i386-linux-gnu/libm-2.19.so
	0xb69f6000-0xb6a22000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a22000-0xb6a23000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a23000-0xb6a24000	/usr/lib/i386-linux-gnu/libasan.so.0.0.0
	0xb6a24000-0xb7fd7000
	0xb7fd7000-0xb7fdd000
	0xb7fdd000-0xb7fde000	[vdso]
	0xb7fde000-0xb7ffe000	/lib/i386-linux-gnu/ld-2.19.so
	0xb7ffe000-0xb7fff000	/lib/i386-linux-gnu/ld-2.19.so
	0xb7fff000-0xb8000000	/lib/i386-linux-gnu/ld-2.19.so
	0xbffdf000-0xc0000000	[stack]
==25915== End of process memory map.
==25915== AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:70 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
    #0 0xb6a084b2 (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x124b2)
    #1 0xb6a110dc (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1b0dc)
    #2 0xb6a14093 (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1e093)
    #3 0xb69fe2ed (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x82ed)
    #4 0xb6a0c88b (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x1688b)
    #5 0x807f235 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x807f235)
    #6 0x806cd76 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x806cd76)
    #7 0x8054402 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8054402)
    #8 0x8074000 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8074000)
    #9 0x8054402 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x8054402)
    #10 0x80497d7 (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x80497d7)
    #11 0xb671faf2 (/lib/i386-linux-gnu/libc-2.19.so+0x19af2)
    #12 0x804a01f (/root/test/libming-ming-0_4_8/util/.libs/lt-swftophp+0x804a01f)


--- end body ---

A memory allocation failure in the readBytes function of libming version 0.48 can lead to a Denial of Service (DoS) when processing specially crafted SWF files. The issue arises when the program attempts to allocate an excessively large amount of memory based on incorrect file size information, resulting in invalid memory access and potential crashes.