The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure.
version: master(**commit 50098023446a5412efcfbd40552821a8cba983a6**)
command: **listswf $FILE**
OS: **Ubuntu 16.04.4 LTS 64bit**

```
$ ./install-asan/bin/listswf poc >/dev/null
header indicates a filesize of 1995 but filesize is 1916
==19625==WARNING: AddressSanitizer failed to allocate 0xfffffffffffffffe bytes
==19625==AddressSanitizer's allocator is terminating the process instead of returning 0
==19625==If you don't like this behavior set allocator_may_return_null=1
==19625==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_allocator.cc:147 "((0)) != (0)" (0x0, 0x0)
    #0 0x7f9290d80631  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
    #1 0x7f9290d855e3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa55e3)
    #2 0x7f9290cfd425  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x1d425)
    #3 0x7f9290d83865  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa3865)
    #4 0x7f9290d02b4d  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22b4d)
    #5 0x7f9290d785d2 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x985d2)
    #6 0x44dec2 in readBytes /home/wdw/experiment/aflgo/libming/util/read.c:252
    #7 0x437290 in parseSWF_DEFINEBITSJPEG2 /home/wdw/experiment/aflgo/libming/util/parser.c:1493
    #8 0x419c15 in blockParse /home/wdw/experiment/aflgo/libming/util/blocktypes.c:145
    #9 0x415a68 in readMovie /home/wdw/experiment/aflgo/libming/util/main.c:269
    #10 0x41624e in main /home/wdw/experiment/aflgo/libming/util/main.c:354
    #11 0x7f929041782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x401aa8 in _start (/home/wdw/experiment/aflgo/libming/install-asan/bin/listswf+0x401aa8)

```

Download: [poc](https://github.com/waugustus/poc/blob/master/libming/memory-allocate-failure_read.c-252)
Memory allocation failure in readBytes (read.c:252)
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory allocation failure in readBytes (read.c:252)
Issue date:

--- start body ---
version: master(**commit 50098023446a5412efcfbd40552821a8cba983a6**)
command: **listswf $FILE**
OS: **Ubuntu 16.04.4 LTS 64bit**

```
$ ./install-asan/bin/listswf poc >/dev/null
header indicates a filesize of 1995 but filesize is 1916
==19625==WARNING: AddressSanitizer failed to allocate 0xfffffffffffffffe bytes
==19625==AddressSanitizer's allocator is terminating the process instead of returning 0
==19625==If you don't like this behavior set allocator_may_return_null=1
==19625==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_allocator.cc:147 "((0)) != (0)" (0x0, 0x0)
    #0 0x7f9290d80631  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
    #1 0x7f9290d855e3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa55e3)
    #2 0x7f9290cfd425  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x1d425)
    #3 0x7f9290d83865  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa3865)
    #4 0x7f9290d02b4d  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22b4d)
    #5 0x7f9290d785d2 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x985d2)
    #6 0x44dec2 in readBytes /home/wdw/experiment/aflgo/libming/util/read.c:252
    #7 0x437290 in parseSWF_DEFINEBITSJPEG2 /home/wdw/experiment/aflgo/libming/util/parser.c:1493
    #8 0x419c15 in blockParse /home/wdw/experiment/aflgo/libming/util/blocktypes.c:145
    #9 0x415a68 in readMovie /home/wdw/experiment/aflgo/libming/util/main.c:269
    #10 0x41624e in main /home/wdw/experiment/aflgo/libming/util/main.c:354
    #11 0x7f929041782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x401aa8 in _start (/home/wdw/experiment/aflgo/libming/install-asan/bin/listswf+0x401aa8)

```

Download: [poc](https://github.com/waugustus/poc/blob/master/libming/memory-allocate-failure_read.c-252)
--- end body ---

A memory allocation failure in the readBytes function of libming can lead to a Denial of Service (DoS) condition. The issue arises when the program attempts to allocate an excessively large amount of memory (0xfffffffffffffffe bytes), which is not feasible, causing AddressSanitizer to terminate the process instead of returning a null pointer. This indicates a potential vulnerability in handling memory allocation, especially when processing malformed SWF files.