CVE-2021-39591

What it actually does

NULL pointer dereference in swf_GetShapeBoundingBox() within swfshape.c causes the application to crash when parsing a malformed SWF file.

Why it matters to the business

Untrusted SWF files can force the swftools utilities to terminate unexpectedly, interrupting batch processing, conversion workflows, and any automated pipelines that depend on the tools.

How an attack unfolds

An attacker supplies a crafted SWF file containing a shape record that leaves a required pointer NULL; when swftools invokes swf_GetShapeBoundingBox during parsing, the dereference triggers an immediate crash.

How to fix it

No official fixed versions are published; discontinue use of swftools on untrusted input, replace the tool with a maintained alternative, or apply a local patch that adds a NULL check before dereferencing the pointer in swfshape.c.

How to confirm the fix worked

Confirm exposure by running the affected swftools binary against a minimal SWF that exercises swf_GetShapeBoundingBox; success is indicated by an immediate segmentation fault or abort. After mitigation, re-test with the same file to verify the crash no longer occurs.

Typical attack path

1. Generate or obtain a malicious SWF file that triggers the NULL pointer path
2. Deliver the file to a victim system or automated processor that uses swftools
3. Victim or process opens the file, causing swf_GetShapeBoundingBox to be called
4. Application crashes, producing a denial-of-service condition

How to detect it

Review system and application logs for segmentation faults or abrupt terminations of swftools binaries immediately after SWF file access; correlate with file-access timestamps to identify suspicious inputs.

What your security team should do

• Remove or sandbox swftools from any environment that processes external files
• Add file-type and source validation to block SWF ingestion where possible
• Monitor process crash logs and set resource limits to contain impact
• Replace swftools with a supported library or utility in all pipelines