A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
### Envrionment
```bash
 ubuntu  ~/lab/libming/util   master  lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.2 LTS
Release:        22.04
Codename:       jammy
```

### Compiler
```bash
 ubuntu  ~/lab/libming/util   master  clang -v
Ubuntu clang version 14.0.0-1ubuntu1.1
Target: x86_64-pc-linux-gnu
Thread model: posix
```

### Step to reproduce
```bash
./autogen.sh
./configure --disable-shared
cd util
make swftophp
./swftophp <PoC file>
```

### Affected Version

libming v0.4.8 (https://github.com/libming/libming/releases/tag/ming-0_4_8)


### Contents of PoC file
[poc.zip](https://github.com/libming/libming/files/13924747/poc.zip)

### Expected Behavior
Print error or warning messages handled within swftophp.

### Current Behavior
* stdout
```
<?php
$m = new SWFMovie(10);

ming_setscale(1.0);
$m->setRate(7.027344);
$m->setDimension(0, 0);
$m->setFrames(1799);
/*Unknown block type 992*/

/* SWF_REMOVEOBJECT2 */
$m->remove($i2810);

/* SWF_DEFINEBUTTON */
skipping 0 bytes

/* SWF_PATHSAREPOSTSCRIPT */

/* SWF_NAMECHARACTER */

/* SWF_REMOVEOBJECT2 */
$m->remove($i1799);
/*Unknown block type 349*/

/* SWF_DOACTION */
$m->add(new SWFAction("") );

/* SWF_JPEGTABLES */

/* SWF_DOACTION */

```
* stderr
```
header indicates a filesize of 169083242 but filesize is 190
 Stream out of sync after parse of blocktype 28 (SWF_REMOVEOBJECT2). 26 but expecting 31.
 Stream out of sync after parse of blocktype 7 (SWF_DEFINEBUTTON). 39 but expecting 76.
 Stream out of sync after parse of blocktype 40 (SWF_NAMECHARACTER). 97 but expecting 90.
 Stream out of sync after parse of blocktype 28 (SWF_REMOVEOBJECT2). 94 but expecting 99.
Stack blown!! - peek
=================================================================
==18465==ERROR: LeakSanitizer: detected memory leaks

...

Direct leak of 240 byte(s) in 1 object(s) allocated from:
    #0 0x55f070ff26b6 in __interceptor_realloc (/home/ubuntu/lab/libming/util/swftophp+0xbb6b6) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55f0710b2975 in parseSWF_DEFINEBUTTON /home/ubuntu/lab/libming/util/parser.c:1541:41

Direct leak of 152 byte(s) in 1 object(s) allocated from:
    #0 0x55f070ff2478 in __interceptor_calloc (/home/ubuntu/lab/libming/util/swftophp+0xbb478) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55f0710b26d4 in parseSWF_DEFINEBUTTON /home/ubuntu/lab/libming/util/parser.c:1528:47

...

SUMMARY: AddressSanitizer: 42073 byte(s) leaked in 13 allocation(s).

```
You can get full log [here](https://pastebin.com/bwRHeSiW).


https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L1523-L1545

On `parseSWF_DEFINEBUTTON` function, we are allocating heap memories on `Characters` and `Actions`, but never been freed.

This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
Memory leaks on parseSWF_DEFINEBUTTON
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory leaks on parseSWF_DEFINEBUTTON
Issue date:

--- start body ---
### Envrionment
```bash
 ubuntu  ~/lab/libming/util   master  lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.2 LTS
Release:        22.04
Codename:       jammy
```

### Compiler
```bash
 ubuntu  ~/lab/libming/util   master  clang -v
Ubuntu clang version 14.0.0-1ubuntu1.1
Target: x86_64-pc-linux-gnu
Thread model: posix
```

### Step to reproduce
```bash
./autogen.sh
./configure --disable-shared
cd util
make swftophp
./swftophp <PoC file>
```

### Affected Version

libming v0.4.8 (https://github.com/libming/libming/releases/tag/ming-0_4_8)


### Contents of PoC file
[poc.zip](https://github.com/libming/libming/files/13924747/poc.zip)

### Expected Behavior
Print error or warning messages handled within swftophp.

### Current Behavior
* stdout
```
<?php
$m = new SWFMovie(10);

ming_setscale(1.0);
$m->setRate(7.027344);
$m->setDimension(0, 0);
$m->setFrames(1799);
/*Unknown block type 992*/

/* SWF_REMOVEOBJECT2 */
$m->remove($i2810);

/* SWF_DEFINEBUTTON */
skipping 0 bytes

/* SWF_PATHSAREPOSTSCRIPT */

/* SWF_NAMECHARACTER */

/* SWF_REMOVEOBJECT2 */
$m->remove($i1799);
/*Unknown block type 349*/

/* SWF_DOACTION */
$m->add(new SWFAction("") );

/* SWF_JPEGTABLES */

/* SWF_DOACTION */

```
* stderr
```
header indicates a filesize of 169083242 but filesize is 190
 Stream out of sync after parse of blocktype 28 (SWF_REMOVEOBJECT2). 26 but expecting 31.
 Stream out of sync after parse of blocktype 7 (SWF_DEFINEBUTTON). 39 but expecting 76.
 Stream out of sync after parse of blocktype 40 (SWF_NAMECHARACTER). 97 but expecting 90.
 Stream out of sync after parse of blocktype 28 (SWF_REMOVEOBJECT2). 94 but expecting 99.
Stack blown!! - peek
=================================================================
==18465==ERROR: LeakSanitizer: detected memory leaks

...

Direct leak of 240 byte(s) in 1 object(s) allocated from:
    #0 0x55f070ff26b6 in __interceptor_realloc (/home/ubuntu/lab/libming/util/swftophp+0xbb6b6) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55f0710b2975 in parseSWF_DEFINEBUTTON /home/ubuntu/lab/libming/util/parser.c:1541:41

Direct leak of 152 byte(s) in 1 object(s) allocated from:
    #0 0x55f070ff2478 in __interceptor_calloc (/home/ubuntu/lab/libming/util/swftophp+0xbb478) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55f0710b26d4 in parseSWF_DEFINEBUTTON /home/ubuntu/lab/libming/util/parser.c:1528:47

...

SUMMARY: AddressSanitizer: 42073 byte(s) leaked in 13 allocation(s).

```
You can get full log [here](https://pastebin.com/bwRHeSiW).


https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L1523-L1545

On `parseSWF_DEFINEBUTTON` function, we are allocating heap memories on `Characters` and `Actions`, but never been freed.

This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
--- end body ---
