# Memory allocation failure in decompileCALLFUNCTION() at decompile.c:2869

Heap buffer overflow in the latest version of libming at function decompileCALLFUNCTION in util/decompile.c:2869.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.8

## Steps to reproduce
1. download file
```
git clone https://github.com/libming/libming.git libming-ming-0_4_8
```
2. compile libming with ASAN
```
cd libming-ming-0_4_8
git checkout 4e35b4b
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc swftophp
clang -fsanitize=address -lz -lm swftophp.bc -o swftophp_asan
```
3. command for reproducing the error
```
./swftophp_asan poc
```
Download poc:
[libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.zip](https://github.com/libming/libming/files/11731688/libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.zip)

## ASAN report
```
root@a71b82b5d288:~/dataset/libming-ming-0_4_8/obj-bc/bin# ./swftophp_asan  libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.swf 
header indicates a filesize of 4278191411 but filesize is 166
<?php
$m = new SWFMovie();

ming_setscale(1.0);

/* Note: using v5+ syntax for script blocks (original SWF file version was 4)! */

$m->setRate(64.855469);
$m->setDimension(66, 327);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(7440);
 Stream out of sync after parse of blocktype 4 (SWF_PLACEOBJECT). 42 but expecting 58.

/* SWF_PLACEOBJECT */
 Stream out of sync after parse of blocktype 9 (SWF_SETBACKGROUNDCOLOR). 63 but expecting 119.

/* SWF_SETBACKGROUNDCOLOR */
$m->setBackground(0x2f, 0xed, 0xd1);
 Stream out of sync after parse of blocktype 11 (SWF_DEFINETEXT). 139 but expecting 125.

/* SWF_DEFINETEXT */
$character24412 = new SWFText(1);
 Could not process long block with length 4022211212: blocks with length > 2147483647 not supported on this system

/* SWF_DOACTION */
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19511==ERROR: AddressSanitizer: SEGV on unknown address 0x60dffffffff0 (pc 0x0000004ff6c6 bp 0x7ffce029f3f0 sp 0x7ffce029f3c0 T0)
==19511==The signal is caused by a READ memory access.
    #0 0x4ff6c6 in decompileCALLFUNCTION /root/dataset/libming-ming-0_4_8/util/decompile.c:2869:2
    #1 0x4fadef in decompileAction /root/dataset/libming-ming-0_4_8/util/decompile.c:3269:10
    #2 0x501b97 in decompileActions /root/dataset/libming-ming-0_4_8/util/decompile.c:3406:6
    #3 0x503ba1 in decompile5Action /root/dataset/libming-ming-0_4_8/util/decompile.c:3428:2
    #4 0x4f7865 in outputSWF_DOACTION /root/dataset/libming-ming-0_4_8/util/outputscript.c:1548:29
    #5 0x4f72ac in outputBlock /root/dataset/libming-ming-0_4_8/util/outputscript.c:2079:4
    #6 0x4f9d7d in readMovie /root/dataset/libming-ming-0_4_8/util/main.c:286:4
    #7 0x4f984d in main /root/dataset/libming-ming-0_4_8/util/main.c:359:2
    #8 0x7f84aa297c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b8d9 in _start (/root/dataset/libming-ming-0_4_8/obj-bc/bin/swftophp_asan+0x41b8d9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/dataset/libming-ming-0_4_8/util/decompile.c:2869:2 in decompileCALLFUNCTION
==19511==ABORTING

```
Memory allocation failure in decompileCALLFUNCTION() at decompile.c:2869
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory allocation failure in decompileCALLFUNCTION() at decompile.c:2869
Issue date:

--- start body ---
# Memory allocation failure in decompileCALLFUNCTION() at decompile.c:2869

Heap buffer overflow in the latest version of libming at function decompileCALLFUNCTION in util/decompile.c:2869.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.8

## Steps to reproduce
1. download file
```
git clone https://github.com/libming/libming.git libming-ming-0_4_8
```
2. compile libming with ASAN
```
cd libming-ming-0_4_8
git checkout 4e35b4b
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc swftophp
clang -fsanitize=address -lz -lm swftophp.bc -o swftophp_asan
```
3. command for reproducing the error
```
./swftophp_asan poc
```
Download poc:
[libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.zip](https://github.com/libming/libming/files/11731688/libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.zip)

## ASAN report
```
root@a71b82b5d288:~/dataset/libming-ming-0_4_8/obj-bc/bin# ./swftophp_asan  libming_0-4-8_swftophp_memory-allocation-failure_decompile2869.swf 
header indicates a filesize of 4278191411 but filesize is 166
<?php
$m = new SWFMovie();

ming_setscale(1.0);

/* Note: using v5+ syntax for script blocks (original SWF file version was 4)! */

$m->setRate(64.855469);
$m->setDimension(66, 327);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(7440);
 Stream out of sync after parse of blocktype 4 (SWF_PLACEOBJECT). 42 but expecting 58.

/* SWF_PLACEOBJECT */
 Stream out of sync after parse of blocktype 9 (SWF_SETBACKGROUNDCOLOR). 63 but expecting 119.

/* SWF_SETBACKGROUNDCOLOR */
$m->setBackground(0x2f, 0xed, 0xd1);
 Stream out of sync after parse of blocktype 11 (SWF_DEFINETEXT). 139 but expecting 125.

/* SWF_DEFINETEXT */
$character24412 = new SWFText(1);
 Could not process long block with length 4022211212: blocks with length > 2147483647 not supported on this system

/* SWF_DOACTION */
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19511==ERROR: AddressSanitizer: SEGV on unknown address 0x60dffffffff0 (pc 0x0000004ff6c6 bp 0x7ffce029f3f0 sp 0x7ffce029f3c0 T0)
==19511==The signal is caused by a READ memory access.
    #0 0x4ff6c6 in decompileCALLFUNCTION /root/dataset/libming-ming-0_4_8/util/decompile.c:2869:2
    #1 0x4fadef in decompileAction /root/dataset/libming-ming-0_4_8/util/decompile.c:3269:10
    #2 0x501b97 in decompileActions /root/dataset/libming-ming-0_4_8/util/decompile.c:3406:6
    #3 0x503ba1 in decompile5Action /root/dataset/libming-ming-0_4_8/util/decompile.c:3428:2
    #4 0x4f7865 in outputSWF_DOACTION /root/dataset/libming-ming-0_4_8/util/outputscript.c:1548:29
    #5 0x4f72ac in outputBlock /root/dataset/libming-ming-0_4_8/util/outputscript.c:2079:4
    #6 0x4f9d7d in readMovie /root/dataset/libming-ming-0_4_8/util/main.c:286:4
    #7 0x4f984d in main /root/dataset/libming-ming-0_4_8/util/main.c:359:2
    #8 0x7f84aa297c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b8d9 in _start (/root/dataset/libming-ming-0_4_8/obj-bc/bin/swftophp_asan+0x41b8d9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/dataset/libming-ming-0_4_8/util/decompile.c:2869:2 in decompileCALLFUNCTION
==19511==ABORTING

```
--- end body ---

A memory allocation failure in the decompileCALLFUNCTION function of libming v0.4.8 leads to a heap buffer overflow, which can be exploited to cause a segmentation fault. This vulnerability can be triggered by specially crafted SWF files, resulting in a Denial of Service (DoS) condition.