# Memory allocation failure in dumpBuffer() at read.c:467

Memory allocation failure in the listswf at function dumpBuffer in util/read.c:467.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.7

## Steps to reproduce
1. download file
```
git clone https://github.com/libming/libming.git libming-ming-0_4_7
```
2. compile libming with ASAN
```
cd libming-ming-0_4_7
git checkout 5aa3470
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc listswf
clang -fsanitize=address -lz -lm listswf.bc -o listswf_asan
```
3. command for reproducing the error
```
./listswf_asan poc
```
Download poc: 
[libming_0-4-7_listswf_memory-allocation-failure_read467.zip](https://github.com/libming/libming/files/11731684/libming_0-4-7_listswf_memory-allocation-failure_read467.zip)

## ASAN report
```
root@a71b82b5d288:~/dataset/libming-ming-0_4_7/obj-bc/bin# ./listswf_asan libming_0-4-7_listswf_memory-allocation-failure_read467.swf 
header indicates a filesize of 3279 but filesize is 192
File version: 10
File size: 192
Frame size: (0,0)x(0,0)
Frame rate: 165.609375 / sec.
Total frames: 3541

Offset: 13 (0x000d)
Block type: 87 (SWF_DEFINEBINARYDATA)
Block length: 46


0000: AddressSanitizer:DEADLYSIGNAL
=================================================================
==29670==ERROR: AddressSanitizer: SEGV on unknown address 0xfffffffff0071865 (pc 0x00000051687f bp 0x7ffd6469ee00 sp 0x7ffd6469ede0 T0)
==29670==The signal is caused by a READ memory access.
    #0 0x51687f in dumpBuffer /root/dataset/libming-ming-0_4_7/util/read.c:467:23
    #1 0x4f8bdc in outputSWF_UNKNOWNBLOCK /root/dataset/libming-ming-0_4_7/util/outputtxt.c:2870:3
    #2 0x4f8b96 in outputBlock /root/dataset/libming-ming-0_4_7/util/outputtxt.c:2937:3
    #3 0x4fcf51 in readMovie /root/dataset/libming-ming-0_4_7/util/main.c:277:4
    #4 0x4fca7d in main /root/dataset/libming-ming-0_4_7/util/main.c:350:2
    #5 0x7fcc253b5c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41b849 in _start (/root/dataset/libming-ming-0_4_7/obj-bc/bin/listswf_asan+0x41b849)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/dataset/libming-ming-0_4_7/util/read.c:467:23 in dumpBuffer
==29670==ABORTING

```
Memory allocation failure in dumpBuffer() at read.c:467
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory allocation failure in dumpBuffer() at read.c:467
Issue date:

--- start body ---
# Memory allocation failure in dumpBuffer() at read.c:467

Memory allocation failure in the listswf at function dumpBuffer in util/read.c:467.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.7

## Steps to reproduce
1. download file
```
git clone https://github.com/libming/libming.git libming-ming-0_4_7
```
2. compile libming with ASAN
```
cd libming-ming-0_4_7
git checkout 5aa3470
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc listswf
clang -fsanitize=address -lz -lm listswf.bc -o listswf_asan
```
3. command for reproducing the error
```
./listswf_asan poc
```
Download poc: 
[libming_0-4-7_listswf_memory-allocation-failure_read467.zip](https://github.com/libming/libming/files/11731684/libming_0-4-7_listswf_memory-allocation-failure_read467.zip)

## ASAN report
```
root@a71b82b5d288:~/dataset/libming-ming-0_4_7/obj-bc/bin# ./listswf_asan libming_0-4-7_listswf_memory-allocation-failure_read467.swf 
header indicates a filesize of 3279 but filesize is 192
File version: 10
File size: 192
Frame size: (0,0)x(0,0)
Frame rate: 165.609375 / sec.
Total frames: 3541

Offset: 13 (0x000d)
Block type: 87 (SWF_DEFINEBINARYDATA)
Block length: 46


0000: AddressSanitizer:DEADLYSIGNAL
=================================================================
==29670==ERROR: AddressSanitizer: SEGV on unknown address 0xfffffffff0071865 (pc 0x00000051687f bp 0x7ffd6469ee00 sp 0x7ffd6469ede0 T0)
==29670==The signal is caused by a READ memory access.
    #0 0x51687f in dumpBuffer /root/dataset/libming-ming-0_4_7/util/read.c:467:23
    #1 0x4f8bdc in outputSWF_UNKNOWNBLOCK /root/dataset/libming-ming-0_4_7/util/outputtxt.c:2870:3
    #2 0x4f8b96 in outputBlock /root/dataset/libming-ming-0_4_7/util/outputtxt.c:2937:3
    #3 0x4fcf51 in readMovie /root/dataset/libming-ming-0_4_7/util/main.c:277:4
    #4 0x4fca7d in main /root/dataset/libming-ming-0_4_7/util/main.c:350:2
    #5 0x7fcc253b5c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41b849 in _start (/root/dataset/libming-ming-0_4_7/obj-bc/bin/listswf_asan+0x41b849)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/dataset/libming-ming-0_4_7/util/read.c:467:23 in dumpBuffer
==29670==ABORTING

```
--- end body ---

A memory allocation failure in the dumpBuffer function of libming v0.4.7 can lead to a segmentation fault when processing specially crafted SWF files. This indicates a potential vulnerability that could be exploited to cause a Denial of Service (DoS) or potentially execute arbitrary code if the memory corruption is leveraged.