==9626==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000005f0 at pc 0x0000005403e7 bp 0x7ffef2d933d0 sp 0x7ffef2d933c8
READ of size 1 at 0x6120000005f0 thread T0
    #0 0x5403e6 in decompileCALLFUNCTION /libming-ming-0_4_8/util/decompile.c:2864:2
    #1 0x52c925 in decompileAction /libming-ming-0_4_8/util/decompile.c:3264:10
    #2 0x5471d0 in decompileActions /libming-ming-0_4_8/util/decompile.c:3401:6
    #3 0x546dd6 in decompile5Action /libming-ming-0_4_8/util/decompile.c:3423:2
    #4 0x51f261 in outputSWF_DOACTION /libming-ming-0_4_8/util/outputscript.c:1548:29
    #5 0x51c3c9 in outputBlock /libming-ming-0_4_8/util/outputscript.c:2079:4
    #6 0x5287fe in readMovie /libming-ming-0_4_8/util/main.c:277:4
    #7 0x526ddc in main /libming-ming-0_4_8/util/main.c:350:2
    #8 0x7f2fa17eb82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
    #9 0x419ed8 in _start (/libming-ming-0_4_8/util/swftophp+0x419ed8)

0x6120000005f0 is located 40 bytes to the right of 264-byte region [0x6120000004c0,0x6120000005c8)
allocated by thread T0 here:
    #0 0x4d2750 in calloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x57ffc5 in parseSWF_DOACTION /libming-ming-0_4_8/util/parser.c:2428:3
    #2 0x5298b5 in blockParse /libming-ming-0_4_8/util/blocktypes.c:145:14
    #3 0x5285bb in readMovie /libming-ming-0_4_8/util/main.c:265:11
    #4 0x526ddc in main /libming-ming-0_4_8/util/main.c:350:2
    #5 0x7f2fa17eb82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /libming-ming-0_4_8/util/decompile.c:2864:2 in decompileCALLFUNCTION
Shadow bytes around the buggy address:
  0x0c247fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c247fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fff8080: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff80b0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa[fa]fa
  0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9626==ABORTING
Heap Buffer Overflow in function decompileCALLFUNCTION decompile.c 2864
This is a GitHub Issue
repo:libming
owner:libming
Title : Heap Buffer Overflow in function decompileCALLFUNCTION decompile.c 2864
Issue date:

--- start body ---
==9626==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000005f0 at pc 0x0000005403e7 bp 0x7ffef2d933d0 sp 0x7ffef2d933c8
READ of size 1 at 0x6120000005f0 thread T0
    #0 0x5403e6 in decompileCALLFUNCTION /libming-ming-0_4_8/util/decompile.c:2864:2
    #1 0x52c925 in decompileAction /libming-ming-0_4_8/util/decompile.c:3264:10
    #2 0x5471d0 in decompileActions /libming-ming-0_4_8/util/decompile.c:3401:6
    #3 0x546dd6 in decompile5Action /libming-ming-0_4_8/util/decompile.c:3423:2
    #4 0x51f261 in outputSWF_DOACTION /libming-ming-0_4_8/util/outputscript.c:1548:29
    #5 0x51c3c9 in outputBlock /libming-ming-0_4_8/util/outputscript.c:2079:4
    #6 0x5287fe in readMovie /libming-ming-0_4_8/util/main.c:277:4
    #7 0x526ddc in main /libming-ming-0_4_8/util/main.c:350:2
    #8 0x7f2fa17eb82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
    #9 0x419ed8 in _start (/libming-ming-0_4_8/util/swftophp+0x419ed8)

0x6120000005f0 is located 40 bytes to the right of 264-byte region [0x6120000004c0,0x6120000005c8)
allocated by thread T0 here:
    #0 0x4d2750 in calloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x57ffc5 in parseSWF_DOACTION /libming-ming-0_4_8/util/parser.c:2428:3
    #2 0x5298b5 in blockParse /libming-ming-0_4_8/util/blocktypes.c:145:14
    #3 0x5285bb in readMovie /libming-ming-0_4_8/util/main.c:265:11
    #4 0x526ddc in main /libming-ming-0_4_8/util/main.c:350:2
    #5 0x7f2fa17eb82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /libming-ming-0_4_8/util/decompile.c:2864:2 in decompileCALLFUNCTION
Shadow bytes around the buggy address:
  0x0c247fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c247fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fff8080: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff80b0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa[fa]fa
  0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9626==ABORTING
--- end body ---

A heap buffer overflow vulnerability exists in the function decompileCALLFUNCTION of the libming library, specifically at line 2864 of decompile.c. This vulnerability can be exploited to read beyond allocated memory, potentially leading to arbitrary code execution or application crashes. The issue is triggered when certain SWF files are processed, allowing attackers to craft inputs that cause the application to access memory it should not, resulting in a segmentation fault.