==10344==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000000d0 at pc 0x000000541f41 bp 0x7ffd10e1ecc0 sp 0x7ffd10e1ecb8
READ of size 1 at 0x60e0000000d0 thread T0
    #0 0x541f40 in OpCode /libming-ming-0_4_8/util/decompile.c:868:37
    #1 0x541f40 in decompileINCR_DECR /libming-ming-0_4_8/util/decompile.c:1440
    #2 0x522d5b in decompileAction /libming-ming-0_4_8/util/decompile.c:3222:10
    #3 0x55e7b2 in decompileActions /libming-ming-0_4_8/util/decompile.c:3401:6
    #4 0x55e7b2 in decompile5Action /libming-ming-0_4_8/util/decompile.c:3423
    #5 0x5113ca in outputSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/outputscript.c:932:2
    #6 0x517b57 in outputBlock /libming-ming-0_4_8/util/outputscript.c:2079:4
    #7 0x51e973 in readMovie /libming-ming-0_4_8/util/main.c:277:4
    #8 0x51e973 in main /libming-ming-0_4_8/util/main.c:350
    #9 0x7f0fbe73b82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
    #10 0x419fa8 in _start (/libming-ming-0_4_8/util/swftophp+0x419fa8)

0x60e0000000d0 is located 144 bytes inside of 152-byte region [0x60e000000040,0x60e0000000d8)
freed by thread T0 here:
    #0 0x4d2a38 in realloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x572e7d in parseSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/parser.c:1571:50

previously allocated by thread T0 here:
    #0 0x4d2820 in calloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x572d52 in parseSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/parser.c:1567:26

SUMMARY: AddressSanitizer: heap-use-after-free /libming-ming-0_4_8/util/decompile.c:868:37 in OpCode
Shadow bytes around the buggy address:
  0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c1c7fff8010: fd fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa
  0x0c1c7fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8030: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10344==ABORTING
heap-use-after-free in decompileINCR_DECR (decompile.c)
This is a GitHub Issue
repo:libming
owner:libming
Title : heap-use-after-free in decompileINCR_DECR (decompile.c)
Issue date:

--- start body ---
==10344==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000000d0 at pc 0x000000541f41 bp 0x7ffd10e1ecc0 sp 0x7ffd10e1ecb8
READ of size 1 at 0x60e0000000d0 thread T0
    #0 0x541f40 in OpCode /libming-ming-0_4_8/util/decompile.c:868:37
    #1 0x541f40 in decompileINCR_DECR /libming-ming-0_4_8/util/decompile.c:1440
    #2 0x522d5b in decompileAction /libming-ming-0_4_8/util/decompile.c:3222:10
    #3 0x55e7b2 in decompileActions /libming-ming-0_4_8/util/decompile.c:3401:6
    #4 0x55e7b2 in decompile5Action /libming-ming-0_4_8/util/decompile.c:3423
    #5 0x5113ca in outputSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/outputscript.c:932:2
    #6 0x517b57 in outputBlock /libming-ming-0_4_8/util/outputscript.c:2079:4
    #7 0x51e973 in readMovie /libming-ming-0_4_8/util/main.c:277:4
    #8 0x51e973 in main /libming-ming-0_4_8/util/main.c:350
    #9 0x7f0fbe73b82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
    #10 0x419fa8 in _start (/libming-ming-0_4_8/util/swftophp+0x419fa8)

0x60e0000000d0 is located 144 bytes inside of 152-byte region [0x60e000000040,0x60e0000000d8)
freed by thread T0 here:
    #0 0x4d2a38 in realloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #1 0x572e7d in parseSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/parser.c:1571:50

previously allocated by thread T0 here:
    #0 0x4d2820 in calloc /fuzzer/build/llvm_tools/llvm-4.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x572d52 in parseSWF_DEFINEBUTTON2 /libming-ming-0_4_8/util/parser.c:1567:26

SUMMARY: AddressSanitizer: heap-use-after-free /libming-ming-0_4_8/util/decompile.c:868:37 in OpCode
Shadow bytes around the buggy address:
  0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c1c7fff8010: fd fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa
  0x0c1c7fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8030: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10344==ABORTING
--- end body ---

A heap-use-after-free vulnerability in the decompileINCR_DECR function of libming allows attackers to exploit memory management issues, potentially leading to arbitrary code execution or application crashes. This occurs when the program attempts to access memory that has already been freed, as indicated by the AddressSanitizer error report.