{"action":"closed","issue":{"url":"https://api.github.com/repos/libming/libming/issues/112","repository_url":"https://api.github.com/repos/libming/libming","labels_url":"https://api.github.com/repos/libming/libming/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/libming/libming/issues/112/comments","events_url":"https://api.github.com/repos/libming/libming/issues/112/events","html_url":"https://github.com/libming/libming/issues/112","id":302994944,"number":112,"title":"heap-buffer-overflow in getString(util/decompile.c:349)","user":{"login":"fantasy7082","id":19205381,"avatar_url":"https://avatars3.githubusercontent.com/u/19205381?v=4","gravatar_id":"","url":"https://api.github.com/users/fantasy7082","html_url":"https://github.com/fantasy7082","followers_url":"https://api.github.com/users/fantasy7082/followers","following_url":"https://api.github.com/users/fantasy7082/following{/other_user}","gists_url":"https://api.github.com/users/fantasy7082/gists{/gist_id}","starred_url":"https://api.github.com/users/fantasy7082/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fantasy7082/subscriptions","organizations_url":"https://api.github.com/users/fantasy7082/orgs","repos_url":"https://api.github.com/users/fantasy7082/repos","events_url":"https://api.github.com/users/fantasy7082/events{/privacy}","received_events_url":"https://api.github.com/users/fantasy7082/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-03-07T07:44:35Z","updated_at":"2018-03-13T07:32:41Z","closed_at":"2018-03-13T07:32:41Z","author_association":"NONE","body":"Hi, i found a heap-buffer-overflow bug in the libming 0.4.8, the details are below(ASAN):\r\n```\r\n./swftocxx 004-heap-over-swf /dev/null\r\n....\r\n...\r\n==15902==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000b090 at pc 0x000000410f70 bp 0x7ffe3f6b0340 sp 0x7ffe3f6b0330\r\nREAD of size 8 at 0x60b00000b090 thread T0\r\n    #0 0x410f6f in getString /root/libming-asan/util/decompile.c:349\r\n    #1 0x4127f1 in newVar_N /root/libming-asan/util/decompile.c:661\r\n    #2 0x41d24c in decompileCALLMETHOD /root/libming-asan/util/decompile.c:2856\r\n    #3 0x41e7ea in decompileAction /root/libming-asan/util/decompile.c:3285\r\n    #4 0x41eba0 in decompileActions /root/libming-asan/util/decompile.c:3419\r\n    #5 0x41c727 in decompileDEFINEFUNCTION /root/libming-asan/util/decompile.c:2759\r\n    #6 0x41e7b8 in decompileAction /root/libming-asan/util/decompile.c:3279\r\n    #7 0x41eba0 in decompileActions /root/libming-asan/util/decompile.c:3419\r\n    #8 0x41b07e in decompileIF /root/libming-asan/util/decompile.c:2581\r\n    #9 0x41e715 in decompileAction /root/libming-asan/util/decompile.c:3260\r\n    #10 0x41eba0 in decompileActions /root/libming-asan/util/decompile.c:3419\r\n    #11 0x41eccd in decompile5Action /root/libming-asan/util/decompile.c:3441\r\n    #12 0x40d221 in outputSWF_INITACTION /root/libming-asan/util/outputscript.c:1860\r\n    #13 0x40e331 in outputBlock /root/libming-asan/util/outputscript.c:2083\r\n    #14 0x40f3d9 in readMovie /root/libming-asan/util/main.c:286\r\n    #15 0x40fb0e in main /root/libming-asan/util/main.c:359\r\n    #16 0x7f49d15e582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n    #17 0x401b58 in _start (/usr/local/libming-asan/bin/swftocxx+0x401b58)\r\n\r\nAddressSanitizer can not describe address in more detail (wild memory access suspected).\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /root/libming-asan/util/decompile.c:349 getString\r\nShadow bytes around the buggy address:\r\n  0x0c167fff95c0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd\r\n  0x0c167fff95d0: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd\r\n  0x0c167fff95e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\r\n  0x0c167fff95f0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 fa\r\n  0x0c167fff9600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=>0x0c167fff9610: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff9620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff9630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff9640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n==15902==ABORTING\r\n\r\n```\r\nPOC FILE:https://github.com/fantasy7082/image_test/blob/master/004-heap-over-swf"}}
{"actor":{"display_login":"strk"}}