heap-use-after-free exit in input() at lib/lex.swf5.c:2620

[Diggingwei]

Summary

A heap-use-after-free caused when using swfc.

Version

$ ./swfc -V
swfc - part of swftools 0.9.2
$ git log --oneline -1
772e55a2 (HEAD, origin/master, origin/HEAD, master)

Platform

$ uname -a
Linux 1cc373898f58 5.4.0-150-generic #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
clang version : 12.0.0

Reproduce

PoC : poc.zip Command Line : ./swfc poc

Debug Info

==52814==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000000d0 at pc 0x0000007bdfd1 bp 0x7fffffffc270 sp 0x7fffffffc268
READ of size 8 at 0x6020000000d0 thread T0
    #0 0x7bdfd0 in input /src/project/swftools_project/swftools/lib/lex.swf5.c:2620:24
    #1 0x7bdfd0 in getinput /src/project/swftools_project/swftools/lib/swf5compiler.flex:315:13
    #2 0x7bdfd0 in comment1 /src/project/swftools_project/swftools/lib/swf5compiler.flex:400:16
    #3 0x7bdfd0 in swf5lex /src/project/swftools_project/swftools/lib/swf5compiler.flex:255:12
    #4 0x7f0ec6 in swf5parse /src/project/swftools_project/swftools/lib/swf5compiler.tab.c:3061:16
    #5 0x67fe3d in compileSWFActionCode /src/project/swftools_project/swftools/lib/action/actioncompiler.c:90:6
    #6 0x58fb43 in swf_ActionCompile /src/project/swftools_project/swftools/lib/modules/swfaction.c:1111:11
    #7 0x5005d5 in s_action /src/project/swftools_project/swftools/src/swfc.c:1966:13
    #8 0x541fd0 in c_action /src/project/swftools_project/swftools/src/swfc.c
    #9 0x51b3ad in parseArgumentsForCommand /src/project/swftools_project/swftools/src/swfc.c:4475:5
    #10 0x51b3ad in main /src/project/swftools_project/swftools/src/swfc.c:4598:2
    #11 0x7ffff7c39082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #12 0x41d61d in _start (/src/project/swftools_project/swftools/src/swfc+0x41d61d)

0x6020000000d5 is located 0 bytes to the right of 5-byte region [0x6020000000d0,0x6020000000d5)
freed by thread T0 here:
    #0 0x498612 in free (/src/project/swftools_project/swftools/src/swfc+0x498612)
    #1 0x9734c3 in dict_free_all /src/project/swftools_project/swftools/lib/q.c:1354:17
    #2 0x9734c3 in map_clear /src/project/swftools_project/swftools/lib/q.c:1484:5

previously allocated by thread T0 here:
    #0 0x484174 in strdup (/src/project/swftools_project/swftools/src/swfc+0x484174)    
    #1 0x96b129 in dict_put /src/project/swftools_project/swftools/lib/q.c:1154:14

SUMMARY: AddressSanitizer: heap-use-after-free /src/project/swftools_project/swftools/lib/lex.swf5.c:2620:24 in input
Shadow bytes around the buggy address:
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa fd fa
=>0x0c047fff8010: fa fa fd fd fa fa fd fa fa fa[fd]fa fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8040: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c047fff8050: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8060: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==52814==ABORTING