search

timknip / pyswf

A Python library to read and write SWF files
https://github.com/timknip/pyswf/wiki
MIT License
158 stars 66 forks source link

pyswf is not checking the precense of a negative sceneCount value. #12

Closed crackinglandia closed 11 years ago

crackinglandia commented 11 years ago

I was getting the following exception when parsing a SWF file:

Traceback (most recent call last): File "../../../../swf_detection/tools/decompress_swf.py", line 59, in swf_file = SWF(StringIO(raw_data)) File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/movie.py", line 87, in init self.parse(self._data) File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/movie.py", line 143, in parse self.parse_tags(data) File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 112, in parse_tags tag = self.parse_tag(data) File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 130, in parse_tag tag.parse(data, raw_tag.header.content_length, tag.version) File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 1665, in parse for i in range(0, self.sceneCount): MemoryError

The SWF file was specially crafted with a negative sceneCount value.

Additional information: http://blog.threatexpert.com/2008/05/flash-exploit-goes-wild.html