Skip to content

Segmentation fault in function decompileINCR_DECR, decompile.c 1640 #203

Description

@5hadowblad3

Hi, there.

There is a segmentation fault in the newest master branch 04aee52.
Here is the reproducing command:

swftophp poc

POC:
seg-decompile1640.zip

Here is the reproduce trace reported by ASAN:

==79767==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x00000042782c bp 0x0000000000f0 sp 0x7ffdbd64ccf0 T0)
    #0 0x42782b in decompileINCR_DECR ../../util/decompile.c:1640
    #1 0x44e234 in decompileActions ../../util/decompile.c:3535
    #2 0x44e234 in decompile5Action ../../util/decompile.c:3558
    #3 0x4114d9 in outputSWF_INITACTION ../../util/outputscript.c:1860
    #4 0x402836 in readMovie ../../util/main.c:281
    #5 0x402836 in main ../../util/main.c:354
    #6 0x7fd557eb582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x403b38 in _start (/mnt/data/playground/libming/build/util/swftophp+0x403b38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../../util/decompile.c:1640 decompileINCR_DECR
==79767==ABORTING

The cause might due to the incomplete check related to the index for array regs.
image

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions