Buffer overwrite in dcputchar, decompile.c:116

Hi, there.

There is a buffer overflow in the newest master branch 04aee52 which make the memory writable for the adversary.
Here is the reproducing command:
~~~~
swftophp poc
~~~~

POC:
[overflow-decompile116.zip](https://github.com/libming/libming/files/5127852/overflow-decompile116.zip)




Here is the reproduce trace reported by ASAN:
~~~~
==56940==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x632000014800 at pc 0x000000423d2c bp 0x7ffd3178c6a0 sp 0x7ffd3178c690
 WRITE of size 1 at 0x632000014800 thread T0
     #0 0x423d2b in dcputchar ../../util/decompile.c:116
     #1 0x44664d in decompileIF ../../util/decompile.c:2701
     #2 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #3 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #4 0x446c9c in decompileActions ../../util/decompile.c:3535
     #5 0x446c9c in decompileIF ../../util/decompile.c:2699
     #6 0x446c9c in decompileActions ../../util/decompile.c:3535
     #7 0x446c9c in decompileIF ../../util/decompile.c:2699
     #8 0x446c9c in decompileActions ../../util/decompile.c:3535
     #9 0x446c9c in decompileIF ../../util/decompile.c:2699
     #10 0x446c9c in decompileActions ../../util/decompile.c:3535
     #11 0x446c9c in decompileIF ../../util/decompile.c:2699
     #12 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #13 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #14 0x446c9c in decompileActions ../../util/decompile.c:3535
     #15 0x446c9c in decompileIF ../../util/decompile.c:2699
     #16 0x446c9c in decompileActions ../../util/decompile.c:3535
     #17 0x446c9c in decompileIF ../../util/decompile.c:2699
     #18 0x446c9c in decompileActions ../../util/decompile.c:3535
     #19 0x446c9c in decompileIF ../../util/decompile.c:2699
     #20 0x446c9c in decompileActions ../../util/decompile.c:3535
     #21 0x446c9c in decompileIF ../../util/decompile.c:2699
     #22 0x446c9c in decompileActions ../../util/decompile.c:3535
     #23 0x446c9c in decompileIF ../../util/decompile.c:2699
     #24 0x446c9c in decompileActions ../../util/decompile.c:3535
     #25 0x446c9c in decompileIF ../../util/decompile.c:2699
     #26 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #27 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #28 0x446c9c in decompileActions ../../util/decompile.c:3535
     #29 0x446c9c in decompileIF ../../util/decompile.c:2699
     #30 0x43c38b in decompileActions ../../util/decompile.c:3535
     #31 0x432fd3 in decompileWITH ../../util/decompile.c:2728
     #32 0x432fd3 in decompileAction ../../util/decompile.c:3379
     #33 0x446c9c in decompileActions ../../util/decompile.c:3535
     #34 0x446c9c in decompileIF ../../util/decompile.c:2699
     #35 0x446c9c in decompileActions ../../util/decompile.c:3535
     #36 0x446c9c in decompileIF ../../util/decompile.c:2699
     #37 0x446c9c in decompileActions ../../util/decompile.c:3535
     #38 0x446c9c in decompileIF ../../util/decompile.c:2699
     #39 0x446c9c in decompileActions ../../util/decompile.c:3535
     #40 0x446c9c in decompileIF ../../util/decompile.c:2699
     #41 0x446c9c in decompileActions ../../util/decompile.c:3535
     #42 0x446c9c in decompileIF ../../util/decompile.c:2699
     #43 0x446c9c in decompileActions ../../util/decompile.c:3535
     #44 0x446c9c in decompileIF ../../util/decompile.c:2699
     #45 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #46 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #47 0x446c9c in decompileActions ../../util/decompile.c:3535
     #48 0x446c9c in decompileIF ../../util/decompile.c:2699
     #49 0x43c38b in decompileActions ../../util/decompile.c:3535
     #50 0x432fd3 in decompileWITH ../../util/decompile.c:2728
     #51 0x432fd3 in decompileAction ../../util/decompile.c:3379
     #52 0x446c9c in decompileActions ../../util/decompile.c:3535
     #53 0x446c9c in decompileIF ../../util/decompile.c:2699
     #54 0x446c9c in decompileActions ../../util/decompile.c:3535
     #55 0x446c9c in decompileIF ../../util/decompile.c:2699
     #56 0x446c9c in decompileActions ../../util/decompile.c:3535
     #57 0x446c9c in decompileIF ../../util/decompile.c:2699
     #58 0x446c9c in decompileActions ../../util/decompile.c:3535
     #59 0x446c9c in decompileIF ../../util/decompile.c:2699
     #60 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #61 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #62 0x446c9c in decompileActions ../../util/decompile.c:3535
     #63 0x446c9c in decompileIF ../../util/decompile.c:2699
     #64 0x446c9c in decompileActions ../../util/decompile.c:3535
     #65 0x446c9c in decompileIF ../../util/decompile.c:2699
     #66 0x446c9c in decompileActions ../../util/decompile.c:3535
     #67 0x446c9c in decompileIF ../../util/decompile.c:2699
     #68 0x446c9c in decompileActions ../../util/decompile.c:3535
     #69 0x446c9c in decompileIF ../../util/decompile.c:2699
     #70 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #71 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #72 0x446c9c in decompileActions ../../util/decompile.c:3535
     #73 0x446c9c in decompileIF ../../util/decompile.c:2699
     #74 0x446c9c in decompileActions ../../util/decompile.c:3535
     #75 0x446c9c in decompileIF ../../util/decompile.c:2699
     #76 0x446c9c in decompileActions ../../util/decompile.c:3535
     #77 0x446c9c in decompileIF ../../util/decompile.c:2699
     #78 0x446c9c in decompileActions ../../util/decompile.c:3535
     #79 0x446c9c in decompileIF ../../util/decompile.c:2699
     #80 0x446c9c in decompileActions ../../util/decompile.c:3535
     #81 0x446c9c in decompileIF ../../util/decompile.c:2699
     #82 0x446c9c in decompileActions ../../util/decompile.c:3535
     #83 0x446c9c in decompileIF ../../util/decompile.c:2699
     #84 0x43d3d4 in decompileActions ../../util/decompile.c:3535
     #85 0x43d3d4 in decompileSETTARGET ../../util/decompile.c:3211
     #86 0x446c9c in decompileActions ../../util/decompile.c:3535
     #87 0x446c9c in decompileIF ../../util/decompile.c:2699
     #88 0x446c9c in decompileActions ../../util/decompile.c:3535
     #89 0x446c9c in decompileIF ../../util/decompile.c:2699
     #90 0x446c9c in decompileActions ../../util/decompile.c:3535
     #91 0x446c9c in decompileIF ../../util/decompile.c:2699
     #92 0x446c9c in decompileActions ../../util/decompile.c:3535
     #93 0x446c9c in decompileIF ../../util/decompile.c:2699
     #94 0x446c9c in decompileActions ../../util/decompile.c:3535
     #95 0x446c9c in decompileIF ../../util/decompile.c:2699
     #96 0x446c9c in decompileActions ../../util/decompile.c:3535
     #97 0x446c9c in decompileIF ../../util/decompile.c:2699
     #98 0x44e234 in decompileActions ../../util/decompile.c:3535
     #99 0x44e234 in decompile5Action ../../util/decompile.c:3558
     #100 0x411304 in outputSWF_DOACTION ../../util/outputscript.c:1551
     #101 0x402836 in readMovie ../../util/main.c:281
     #102 0x402836 in main ../../util/main.c:354
     #103 0x7f3d2247882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
     #104 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)
 
 0x632000014800 is located 0 bytes to the right of 81920-byte region [0x632000000800,0x632000014800)
 allocated by thread T0 here:
     #0 0x7f3d22ddd9c1 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989c1)
     #1 0x423b60 in dcchkstr ../../util/decompile.c:93
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow ../../util/decompile.c:116 dcputchar
 Shadow bytes around the buggy address:
   0x0c647fffa8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c647fffa8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c647fffa900:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c647fffa950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Heap right redzone:      fb
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack partial redzone:   f4
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
 ==56940==ABORTING
~~~~


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Buffer overwrite in dcputchar, decompile.c:116 #207

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Buffer overwrite in dcputchar, decompile.c:116 #207

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions