CVE-2022-35113

What it actually does

Heap buffer overflow in swf_DefineLosslessBitsTagToImage within swfbits.c allows out-of-bounds memory writes when processing malformed lossless bitmap tags in SWF files.

Why it matters to the business

Processing untrusted SWF content can crash the application or corrupt memory, disrupting workflows that rely on SWFTools for file conversion or rendering and increasing operational downtime.

How an attack unfolds

An attacker crafts a malicious SWF file containing an oversized or malformed DefineLosslessBits tag, then convinces a victim to open it with a vulnerable SWFTools binary; the overflow occurs during tag parsing and can be leveraged for denial of service or further memory corruption.

How to fix it

Update to a build that contains the corrected swfbits.c implementation; if no official release is available, compile from a post-772e55a2 commit or apply equivalent bounds checks before processing untrusted SWF files.

How to confirm the fix worked

Rebuild SWFTools from source after applying the fix, then replay a corpus of known-triggering SWF samples and confirm absence of crashes or sanitizer violations under AddressSanitizer.

Typical attack path

1. Craft SWF file with malicious DefineLosslessBits tag
2. Deliver file via email, web download, or shared storage
3. Victim opens file using affected swftools utilities
4. swf_DefineLosslessBitsTagToImage performs out-of-bounds write
5. Application crashes or attacker gains memory corruption primitive

How to detect it

Review application crash logs and core dumps for references to swfbits.c or swf_DefineLosslessBitsTagToImage; correlate with file-access events involving SWF files of anomalous size or structure.

What your security team should do

• Block or sandbox SWFTools execution on untrusted SWF inputs until patched
• Scan build pipelines and developer workstations for the vulnerable commit
• Add SWF file-type restrictions in content-processing workflows
• Monitor for new upstream releases and schedule upgrade within 30 days