```
==22946==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000029a at pc 0x00000044df4b bp 0x7ffccd3a0760 sp 0x7ffccd39ff10
WRITE of size 13 at 0x60200000029a thread T0
    #0 0x44df4a in vsprintf /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1668
    #1 0x44e116 in sprintf /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1711
    #2 0x504bcf in getString /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:342:3
    #3 0x5048e8 in getName /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:418:10
    #4 0x502e79 in decompileCALLMETHOD /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2843:35
    #5 0x4fd067 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3267:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #8 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #11 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #12 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #13 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #14 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #15 0x7f2cff492c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #16 0x41cce9 in _start (/home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/swftophp+0x41cce9)

0x60200000029a is located 0 bytes to the right of 10-byte region [0x602000000290,0x60200000029a)
allocated by thread T0 here:
    #0 0x4ad350 in malloc /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
    #1 0x504ba1 in getString /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:341:5
    #2 0x5048e8 in getName /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:418:10
    #3 0x502e79 in decompileCALLMETHOD /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2843:35
    #4 0x4fd067 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3267:10
    #5 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #6 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #7 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #8 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #9 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #10 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #11 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #12 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #13 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #14 0x7f2cff492c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1668 in vsprintf
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8010: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa 03 fa fa fa fd fa
  0x0c047fff8040: fa fa fd fa fa fa 03 fa fa fa fd fa fa fa fd fa
=>0x0c047fff8050: fa fa 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==22946==ABORTING
```
[poc-10.zip](https://github.com/libming/libming/files/12116194/poc-10.zip)

heap-buffer-overflow on vsprintf
This is a GitHub Issue
repo:libming
owner:libming
Title : heap-buffer-overflow on vsprintf
Issue date:

--- start body ---
```
==22946==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000029a at pc 0x00000044df4b bp 0x7ffccd3a0760 sp 0x7ffccd39ff10
WRITE of size 13 at 0x60200000029a thread T0
    #0 0x44df4a in vsprintf /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1668
    #1 0x44e116 in sprintf /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1711
    #2 0x504bcf in getString /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:342:3
    #3 0x5048e8 in getName /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:418:10
    #4 0x502e79 in decompileCALLMETHOD /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2843:35
    #5 0x4fd067 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3267:10
    #6 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #7 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #8 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #9 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #10 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #11 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #12 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #13 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #14 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #15 0x7f2cff492c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #16 0x41cce9 in _start (/home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/swftophp+0x41cce9)

0x60200000029a is located 0 bytes to the right of 10-byte region [0x602000000290,0x60200000029a)
allocated by thread T0 here:
    #0 0x4ad350 in malloc /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
    #1 0x504ba1 in getString /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:341:5
    #2 0x5048e8 in getName /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:418:10
    #3 0x502e79 in decompileCALLMETHOD /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:2843:35
    #4 0x4fd067 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3267:10
    #5 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #6 0x503dc1 in decompileSETTARGET /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3076:3
    #7 0x4fd309 in decompileAction /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c
    #8 0x50470c in decompileActions /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3401:6
    #9 0x507223 in decompile5Action /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/decompile.c:3423:2
    #10 0x4f2315 in outputSWF_DEFINEBUTTON2 /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:932:2
    #11 0x4f88cd in outputBlock /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/outputscript.c:2079:4
    #12 0x4fbfa9 in readMovie /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:277:4
    #13 0x4fb633 in main /home/eval/Desktop/libming-CVE-2018-8962/obj-aflgo/util/../../util/main.c:350:2
    #14 0x7f2cff492c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/eval/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1668 in vsprintf
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8010: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa 03 fa fa fa fd fa
  0x0c047fff8040: fa fa fd fa fa fa 03 fa fa fa fd fa fa fa fd fa
=>0x0c047fff8050: fa fa 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==22946==ABORTING
```
[poc-10.zip](https://github.com/libming/libming/files/12116194/poc-10.zip)

--- end body ---

A heap-buffer-overflow vulnerability in the libming library allows attackers to exploit the vsprintf function, potentially leading to arbitrary code execution or application crashes. This issue arises when the program attempts to write beyond the allocated memory buffer, as indicated by the AddressSanitizer error report.