timknip/pyswf — pull request #12 by crackinglandia (2013-09-06 02:44:17+00:00)
Title: pyswf is not checking the precense of a negative sceneCount value.

I was getting the following exception when parsing a SWF file:

Traceback (most recent call last):
File "../../../../swf_detection/tools/decompress_swf.py", line 59, in
swf_file = SWF(StringIO(raw_data))
File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/movie.py", line 87, in __init__
self.parse(self._data)
File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/movie.py", line 143, in parse
self.parse_tags(data)
File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 112, in parse_tags
tag = self.parse_tag(data)
File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 130, in parse_tag
tag.parse(data, raw_tag.header.content_length, tag.version)
File "/usr/local/lib/python2.7/dist-packages/pyswf-1.3-py2.7.egg/swf/tag.py", line 1665, in parse
for i in range(0, self.sceneCount):
MemoryError

The SWF file was specially crafted with a negative sceneCount value.

Additional information: http://blog.threatexpert.com/2008/05/flash-exploit-goes-wild.html