Hi, there.

There is a heap-buffer-overflow fault in the newest master branch [04aee52](https://github.com/libming/libming/commit/04aee52363688426eab74f5d6180c149654a6473)
Here is the reproducing command:

`swftophp POC /dev/null`

POC:
[poc-269.zip](https://github.com/libming/libming/files/11146253/poc-269.zip)



Here is the reproduce trace reported by ASAN:
```
=================================================================
==29596==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000539 at pc 0x0000005420ec bp 0x7ffdcdd29860 sp 0x7ffdcdd29858
WRITE of size 1 at 0x603000000539 thread T0
    #0 0x5420eb in strcpyext /home/afl-libming/util/decompile.c:254:11
    #1 0x5420eb in getName /home/afl-libming/util/decompile.c:435:11
    #2 0x52c702 in decompileIF /home/afl-libming/util/decompile.c:2612:4
    #3 0x51503b in decompileAction /home/afl-libming/util/decompile.c:3377:10
    #4 0x53ffd0 in decompileActions /home/afl-libming/util/decompile.c:3536:6
    #5 0x53ffd0 in decompile5Action /home/afl-libming/util/decompile.c:3559:2
    #6 0x509971 in outputSWF_DOACTION /home/afl-libming/util/outputscript.c:1552:29
    #7 0x5076ff in outputBlock /home/afl-libming/util/outputscript.c:2083:4
    #8 0x50f82b in readMovie /home/afl-libming/util/main.c:281:4
    #9 0x50f82b in main /home/afl-libming/util/main.c:354:2
    #10 0x7feee4d1e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #11 0x41c51d in _start (/home/afl-libming/util-asan/swftophp+0x41c51d)

0x603000000539 is located 0 bytes to the right of 25-byte region [0x603000000520,0x603000000539)
allocated by thread T0 here:
    #0 0x4c3977 in __interceptor_malloc /home/llvm-project-llvmorg-13.0.0/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x540d0c in getName /home/afl-libming/util/decompile.c:434:13

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/afl-libming/util/decompile.c:254:11 in strcpyext
Shadow bytes around the buggy address:
  0x0c067fff8050: fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 00 fa
  0x0c067fff8060: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8070: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8090: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
=>0x0c067fff80a0: 00 fa fa fa 00 00 00[01]fa fa fa fa fa fa fa fa
  0x0c067fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29596==ABORTING

```
heap-buffer-overflow in strcpyext, decompile.c:254
This is a GitHub Issue
repo:libming
owner:libming
Title : heap-buffer-overflow in strcpyext, decompile.c:254
Issue date:

--- start body ---
Hi, there.

There is a heap-buffer-overflow fault in the newest master branch [04aee52](https://github.com/libming/libming/commit/04aee52363688426eab74f5d6180c149654a6473)
Here is the reproducing command:

`swftophp POC /dev/null`

POC:
[poc-269.zip](https://github.com/libming/libming/files/11146253/poc-269.zip)



Here is the reproduce trace reported by ASAN:
```
=================================================================
==29596==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000539 at pc 0x0000005420ec bp 0x7ffdcdd29860 sp 0x7ffdcdd29858
WRITE of size 1 at 0x603000000539 thread T0
    #0 0x5420eb in strcpyext /home/afl-libming/util/decompile.c:254:11
    #1 0x5420eb in getName /home/afl-libming/util/decompile.c:435:11
    #2 0x52c702 in decompileIF /home/afl-libming/util/decompile.c:2612:4
    #3 0x51503b in decompileAction /home/afl-libming/util/decompile.c:3377:10
    #4 0x53ffd0 in decompileActions /home/afl-libming/util/decompile.c:3536:6
    #5 0x53ffd0 in decompile5Action /home/afl-libming/util/decompile.c:3559:2
    #6 0x509971 in outputSWF_DOACTION /home/afl-libming/util/outputscript.c:1552:29
    #7 0x5076ff in outputBlock /home/afl-libming/util/outputscript.c:2083:4
    #8 0x50f82b in readMovie /home/afl-libming/util/main.c:281:4
    #9 0x50f82b in main /home/afl-libming/util/main.c:354:2
    #10 0x7feee4d1e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #11 0x41c51d in _start (/home/afl-libming/util-asan/swftophp+0x41c51d)

0x603000000539 is located 0 bytes to the right of 25-byte region [0x603000000520,0x603000000539)
allocated by thread T0 here:
    #0 0x4c3977 in __interceptor_malloc /home/llvm-project-llvmorg-13.0.0/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x540d0c in getName /home/afl-libming/util/decompile.c:434:13

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/afl-libming/util/decompile.c:254:11 in strcpyext
Shadow bytes around the buggy address:
  0x0c067fff8050: fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 00 fa
  0x0c067fff8060: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8070: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8090: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
=>0x0c067fff80a0: 00 fa fa fa 00 00 00[01]fa fa fa fa fa fa fa fa
  0x0c067fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29596==ABORTING

```
--- end body ---

A heap-buffer-overflow vulnerability in the strcpyext function of libming allows attackers to potentially exploit memory corruption issues. This can lead to crashes or arbitrary code execution when processing specially crafted SWF files, as demonstrated by the provided proof of concept (POC).