Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c.
Heap buffer overflow in the latest version of libming at function newVar_N in util/decompile.c:654.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.8

## Steps to reproduce
1. download file
```
wget https://github.com/libming/libming/archive/refs/tags/ming-0_4_8.tar.gz
tar -zxvf ming-0_4_8.tar.gz
```
2. compile libming with ASAN
```
cd libming-ming-0_4_8
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc swftophp
clang -fsanitize=address -lz -lm swftophp.bc -o swftophp_asan
```
3. command for reproducing the error
```
./swftophp_asan poc
```
Download poc: 
[libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.zip](https://github.com/libming/libming/files/11025531/libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.zip)

## ASAN report
```
root@2413df779df0:~/compiler1804/libming-ming-0_4_8/obj-bc/bin# ./swftophp_asan libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.swf 
header indicates a filesize of 0 but filesize is 166
<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(0.000000);
$m->setDimension(0, 1);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(0);

/* SWF_DOACTION */
    16:SWFACTION_FSCOMMAND2
  Can't get int for type: 10
=================================================================
==60490==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000001880 at pc 0x000000439494 bp 0x7ffd310a9d90 sp 0x7ffd310a9540
READ of size 1025 at 0x619000001880 thread T0
    #0 0x439493 in __interceptor_strlen.part.36 /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372
    #1 0x5022e5 in newVar_N /root/compiler1804/libming-ming-0_4_8/util/decompile.c:654:11
    #2 0x4fbe07 in decompileNEWOBJECT /root/compiler1804/libming-ming-0_4_8/util/decompile.c:1588:7
    #3 0x4fab64 in decompileAction /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3190:3
    #4 0x501b27 in decompileActions /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3401:6
    #5 0x503b31 in decompile5Action /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3423:2
    #6 0x4f7865 in outputSWF_DOACTION /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:1548:29
    #7 0x4f72ac in outputBlock /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:2079:4
    #8 0x4f9d21 in readMovie /root/compiler1804/libming-ming-0_4_8/util/main.c:277:4
    #9 0x4f984d in main /root/compiler1804/libming-ming-0_4_8/util/main.c:350:2
    #10 0x7fe2276bdc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #11 0x41b8d9 in _start (/root/compiler1804/libming-ming-0_4_8/obj-bc/bin/swftophp_asan+0x41b8d9)

0x619000001880 is located 0 bytes to the right of 1024-byte region [0x619000001480,0x619000001880)
allocated by thread T0 here:
    #0 0x4ae288 in realloc /root/LLVM/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164
    #1 0x502330 in newVar_N /root/compiler1804/libming-ming-0_4_8/util/decompile.c:657:18
    #2 0x4fbe07 in decompileNEWOBJECT /root/compiler1804/libming-ming-0_4_8/util/decompile.c:1588:7
    #3 0x4fab64 in decompileAction /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3190:3
    #4 0x501b27 in decompileActions /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3401:6
    #5 0x503b31 in decompile5Action /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3423:2
    #6 0x4f7865 in outputSWF_DOACTION /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:1548:29
    #7 0x4f72ac in outputBlock /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:2079:4
    #8 0x4f9d21 in readMovie /root/compiler1804/libming-ming-0_4_8/util/main.c:277:4
    #9 0x4f984d in main /root/compiler1804/libming-ming-0_4_8/util/main.c:350:2
    #10 0x7fe2276bdc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372 in __interceptor_strlen.part.36
Shadow bytes around the buggy address:
  0x0c327fff82c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8310:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==60490==ABORTING
```
Heap buffer overflow in newVar_N() at decompile.c:654
This is a GitHub Issue
repo:libming
owner:libming
Title : Heap buffer overflow in newVar_N() at decompile.c:654
Issue date:

--- start body ---
Heap buffer overflow in the latest version of libming at function newVar_N in util/decompile.c:654.

## Environment
Ubuntu 18.04, 64 bit
libming 0.4.8

## Steps to reproduce
1. download file
```
wget https://github.com/libming/libming/archive/refs/tags/ming-0_4_8.tar.gz
tar -zxvf ming-0_4_8.tar.gz
```
2. compile libming with ASAN
```
cd libming-ming-0_4_8
./autogen.sh
export FORCE_UNSAFE_CONFIGURE=1
export LLVM_COMPILER=clang
CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
make
make install

cd obj-bc/bin/
extract-bc swftophp
clang -fsanitize=address -lz -lm swftophp.bc -o swftophp_asan
```
3. command for reproducing the error
```
./swftophp_asan poc
```
Download poc: 
[libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.zip](https://github.com/libming/libming/files/11025531/libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.zip)

## ASAN report
```
root@2413df779df0:~/compiler1804/libming-ming-0_4_8/obj-bc/bin# ./swftophp_asan libming_0-4-8_swftophp_heap-buffer-overflow_decompile654.swf 
header indicates a filesize of 0 but filesize is 166
<?php
$m = new SWFMovie(0);

ming_setscale(1.0);
$m->setRate(0.000000);
$m->setDimension(0, 1);

/* Note: xMin and/or yMin are not 0! */

$m->setFrames(0);

/* SWF_DOACTION */
    16:SWFACTION_FSCOMMAND2
  Can't get int for type: 10
=================================================================
==60490==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000001880 at pc 0x000000439494 bp 0x7ffd310a9d90 sp 0x7ffd310a9540
READ of size 1025 at 0x619000001880 thread T0
    #0 0x439493 in __interceptor_strlen.part.36 /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372
    #1 0x5022e5 in newVar_N /root/compiler1804/libming-ming-0_4_8/util/decompile.c:654:11
    #2 0x4fbe07 in decompileNEWOBJECT /root/compiler1804/libming-ming-0_4_8/util/decompile.c:1588:7
    #3 0x4fab64 in decompileAction /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3190:3
    #4 0x501b27 in decompileActions /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3401:6
    #5 0x503b31 in decompile5Action /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3423:2
    #6 0x4f7865 in outputSWF_DOACTION /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:1548:29
    #7 0x4f72ac in outputBlock /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:2079:4
    #8 0x4f9d21 in readMovie /root/compiler1804/libming-ming-0_4_8/util/main.c:277:4
    #9 0x4f984d in main /root/compiler1804/libming-ming-0_4_8/util/main.c:350:2
    #10 0x7fe2276bdc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #11 0x41b8d9 in _start (/root/compiler1804/libming-ming-0_4_8/obj-bc/bin/swftophp_asan+0x41b8d9)

0x619000001880 is located 0 bytes to the right of 1024-byte region [0x619000001480,0x619000001880)
allocated by thread T0 here:
    #0 0x4ae288 in realloc /root/LLVM/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164
    #1 0x502330 in newVar_N /root/compiler1804/libming-ming-0_4_8/util/decompile.c:657:18
    #2 0x4fbe07 in decompileNEWOBJECT /root/compiler1804/libming-ming-0_4_8/util/decompile.c:1588:7
    #3 0x4fab64 in decompileAction /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3190:3
    #4 0x501b27 in decompileActions /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3401:6
    #5 0x503b31 in decompile5Action /root/compiler1804/libming-ming-0_4_8/util/decompile.c:3423:2
    #6 0x4f7865 in outputSWF_DOACTION /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:1548:29
    #7 0x4f72ac in outputBlock /root/compiler1804/libming-ming-0_4_8/util/outputscript.c:2079:4
    #8 0x4f9d21 in readMovie /root/compiler1804/libming-ming-0_4_8/util/main.c:277:4
    #9 0x4f984d in main /root/compiler1804/libming-ming-0_4_8/util/main.c:350:2
    #10 0x7fe2276bdc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372 in __interceptor_strlen.part.36
Shadow bytes around the buggy address:
  0x0c327fff82c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8310:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==60490==ABORTING
```
--- end body ---
