### Envrionment
```bash
 ubuntu  ~/lab/libming/util   master  lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.2 LTS
Release:        22.04
Codename:       jammy
```

### Compiler
```bash
 ubuntu  ~/lab/libming/util   master  clang -v
Ubuntu clang version 14.0.0-1ubuntu1.1
Target: x86_64-pc-linux-gnu
Thread model: posix
```

### Step to reproduce
```bash
./autogen.sh
./configure --disable-shared
cd util
make swftophp
./swftophp <PoC file>
```

### Affected Version

libming v0.4.8 (https://github.com/libming/libming/releases/tag/ming-0_4_8)


### Contents of PoC file
[poc-2.zip](https://github.com/libming/libming/files/13924982/poc-2.zip)

### Expected Behavior
Print error or warning messages handled within swftophp.

### Current Behavior
* stdout
```
<?php
$m = new SWFMovie(10);

ming_setscale(1.0);
$m->setRate(255.019531);
$m->setDimension(2, -1);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(62719);

/* SWF_PLACEOBJECT */
/*Unknown block type 648*/
skipping 59 bytes

/* SWF_DEFINESPRITE */

	/*  MovieClip 2570 */
$character2570 = new SWFMovieClip(); /* 2314 frames */

/* SWF_FREECHARACTER */

/* SWF_DEFINETEXT2 */
$character2056 = new SWFText(2);
$character2056->moveTo(2815, 2058);
$character2056->addString("X");


0000: 00 00 10 00 00 0a 09 f6  0a a1 09 0a 24 0a 0a 0a    ........ ....$...
0010: 16 01 02                                           ...





	header('Content-type: application/x-shockwave-flash');
$m->output(9);
?>

```
* stderr
```
header indicates a filesize of 18446744071613768297 but filesize is 144
 Stream out of sync after parse of blocktype 39 (SWF_DEFINESPRITE). 105 but expecting 79.
 Stream out of sync after parse of blocktype 33 (SWF_DEFINETEXT2). 113 but expecting 123.
outputSWF_TEXT_RECORD: can't process text record: fonts information list is NULL
sudden file end: read failed @125 fileSize 144, request 42
extra garbage (i.e., we messed up in main): 

=================================================================
==18453==ERROR: LeakSanitizer: detected memory leaks

...

Indirect leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x55ba893d5478 in __interceptor_calloc (/home/ubuntu/lab/libming/util/swftophp+0xbb478) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55ba894aaebf in parseSWF_FREECHARACTER /home/ubuntu/lab/libming/util/parser.c:2534:3

...

SUMMARY: AddressSanitizer: 711 byte(s) leaked in 27 allocation(s).
```
You can get full log [here](https://pastebin.com/53DnWeF0).


### Analysis

https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L39-L52

On `parseSWF_FREECHARACTER` function, just works three MACROS: `PAR_BEGIN`, `PAR_END`, `SKIP`. 

https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L39-L45
On `PAR_BEGIN` macro, we use `calloc` for allocating SWF_Parserstruct. However, this is not been freed, so a memory leak occurs.

This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.

Memory leaks on parseSWF_FREECHARACTER
This is a GitHub Issue
repo:libming
owner:libming
Title : Memory leaks on parseSWF_FREECHARACTER
Issue date:

--- start body ---
### Envrionment
```bash
 ubuntu  ~/lab/libming/util   master  lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.2 LTS
Release:        22.04
Codename:       jammy
```

### Compiler
```bash
 ubuntu  ~/lab/libming/util   master  clang -v
Ubuntu clang version 14.0.0-1ubuntu1.1
Target: x86_64-pc-linux-gnu
Thread model: posix
```

### Step to reproduce
```bash
./autogen.sh
./configure --disable-shared
cd util
make swftophp
./swftophp <PoC file>
```

### Affected Version

libming v0.4.8 (https://github.com/libming/libming/releases/tag/ming-0_4_8)


### Contents of PoC file
[poc-2.zip](https://github.com/libming/libming/files/13924982/poc-2.zip)

### Expected Behavior
Print error or warning messages handled within swftophp.

### Current Behavior
* stdout
```
<?php
$m = new SWFMovie(10);

ming_setscale(1.0);
$m->setRate(255.019531);
$m->setDimension(2, -1);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(62719);

/* SWF_PLACEOBJECT */
/*Unknown block type 648*/
skipping 59 bytes

/* SWF_DEFINESPRITE */

	/*  MovieClip 2570 */
$character2570 = new SWFMovieClip(); /* 2314 frames */

/* SWF_FREECHARACTER */

/* SWF_DEFINETEXT2 */
$character2056 = new SWFText(2);
$character2056->moveTo(2815, 2058);
$character2056->addString("X");


0000: 00 00 10 00 00 0a 09 f6  0a a1 09 0a 24 0a 0a 0a    ........ ....$...
0010: 16 01 02                                           ...





	header('Content-type: application/x-shockwave-flash');
$m->output(9);
?>

```
* stderr
```
header indicates a filesize of 18446744071613768297 but filesize is 144
 Stream out of sync after parse of blocktype 39 (SWF_DEFINESPRITE). 105 but expecting 79.
 Stream out of sync after parse of blocktype 33 (SWF_DEFINETEXT2). 113 but expecting 123.
outputSWF_TEXT_RECORD: can't process text record: fonts information list is NULL
sudden file end: read failed @125 fileSize 144, request 42
extra garbage (i.e., we messed up in main): 

=================================================================
==18453==ERROR: LeakSanitizer: detected memory leaks

...

Indirect leak of 264 byte(s) in 1 object(s) allocated from:
    #0 0x55ba893d5478 in __interceptor_calloc (/home/ubuntu/lab/libming/util/swftophp+0xbb478) (BuildId: 8551de914f0fa059359bb0c15882dbeddbbf77b6)
    #1 0x55ba894aaebf in parseSWF_FREECHARACTER /home/ubuntu/lab/libming/util/parser.c:2534:3

...

SUMMARY: AddressSanitizer: 711 byte(s) leaked in 27 allocation(s).
```
You can get full log [here](https://pastebin.com/53DnWeF0).


### Analysis

https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L39-L52

On `parseSWF_FREECHARACTER` function, just works three MACROS: `PAR_BEGIN`, `PAR_END`, `SKIP`. 

https://github.com/libming/libming/blob/04aee52363688426eab74f5d6180c149654a6473/util/parser.c#L39-L45
On `PAR_BEGIN` macro, we use `calloc` for allocating SWF_Parserstruct. However, this is not been freed, so a memory leak occurs.

This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.

--- end body ---
