bug1 : an heap-buffer-overflow bug of swfmill swf2xml

[ghost]

poc: https://drive.google.com/open?id=1hBFvf2l1Jp8elvm6-HMNf_b6bqd1DzKC asan: https://drive.google.com/open?id=1btf-tyhwl4bzXNgidrYk96xf43RhqOO7

an interger overflow happens at line 3925 of gSWFParser.cpp

  {
        int sz = len;

        data = new unsigned char[ sz ];
        r->getData( data, sz );
    }

the sz comes from len, and when len becomes a really big interger, the new will return false. len is a private member of namespace SWF,

namespace SWF {

    template <class T>
    class IdItem : public Item {
        protected:
            IdItem() { type = 0; len = 0; }

            int getHeaderSize(int size) { return 8; }
            void writeHeader(Writer *w, Context *ctx, size_t len) { w->putByte(type); }

            void setType(int t) { type = t; }
            int getType() { return type; }

            void setLength(int l) { len = l; }
            int getLength() { return len; }

            int type;
            int len;

in the function get Filter *Filter::get(Reader *r, int end, Context *ctx) { the len is from int len = end - r->getPosition(); and it will be a negative number , that's why the new operation fail.