heap-buffer-overflow exists in the function handleEditText in swfdump.c

[SEU-SSL]

System info Ubuntu x86_64, clang 12.0.1 version: last commit 772e55a

Command line ./swfdump poc

Poc poc: poc

AddressSanitizer output ==17968==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000015b4 at pc 0x00000043a0eb bp 0x7fffc859e180 sp 0x7fffc859d908 READ of size 34 at 0x6060000015b4 thread T0 #0 0x43a0ea in printf_common(void*, char const*, __va_list_tag*) /home/brian/src/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:547:9 #1 0x43b42e in __interceptor_vprintf /home/brian/src/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1644:1 #2 0x43b42e in printf /home/brian/src/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1702:1 #3 0x4c7746 in handleEditText /home/SVF-tools/example/swftools/src/swfdump.c:538:5 #4 0x4d0e89 in main /home/SVF-tools/example/swftools/src/swfdump.c:1511:6 #5 0x7f1761908c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310 #6 0x41b849 in _start (/home/SVF-tools/example/swftools/fuzz/swfdump.ci+0x41b849)

0x6060000015b4 is located 0 bytes to the right of 52-byte region [0x606000001580,0x6060000015b4) allocated by thread T0 here: #0 0x493f8d in malloc /home/brian/src/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x52b405 in rfx_alloc /home/SVF-tools/example/swftools/lib/mem.c:30:9 #2 0x52b405 in swf_ReadTag /home/SVF-tools/example/swftools/lib/rfxswf.c:1227:20

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/brian/src/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:547:9 in printf_common(void*, char const*, __va_list_tag*) Shadow bytes around the buggy address: 0x0c0c7fff8260: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa 0x0c0c7fff8270: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa 0x0c0c7fff8280: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 0x0c0c7fff8290: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 01 0x0c0c7fff82a0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa =>0x0c0c7fff82b0: 00 00 00 00 00 00[04]fa fa fa fa fa 00 00 00 00 0x0c0c7fff82c0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa 0x0c0c7fff82d0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa 0x0c0c7fff82e0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 0x0c0c7fff82f0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 04 fa 0x0c0c7fff8300: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==17968==ABORTING