bug3: an interger overflow in swfmill swf2xml

[ghost]

poc: https://drive.google.com/open?id=1Z8WmeSap9iPaiUcVJZCIfrkZfvHUSOSa asan: https://drive.google.com/open?id=1v47arABbjZFQyRV_8lSBOT59jKuTW8gT

swfmill/src/SWFReader.cpp the segmentfault happens at

  char *Reader::getPStringU30() {
        byteAlign();
        uint32_t len = getU30();
        char *dst = new char[len+1];
        getData(dst, len);
        dst[len]=0;
        return dst;
    }

uint32_t len is from getU30(); in this function there exists an interger overflow

uint32_t Reader::getU30() {
        uint32_t r = 0;
        unsigned char c;

        for (int i = 0; i < 5; i++) {
            c = data[pos++];
            r |= (c & 0x7F) << (7 * i);

            if (!(c & 0x80)) {
                return r;
            }

            if (pos > length) {
                err = Reader::eof;
                pos = length+1;
                return 0;
            }
        }

        return r;
    }

r will be 0xffffffff after parsing.