CVE-2021-44591: 
Homebrew vulnerability analysis and mitigation

In libming version 0.4.8, a vulnerability was identified in the parseSWF_DEFINELOSSLESS2 function within util/parser.c. The vulnerability stems from a missing boundary check that can lead to denial-of-service attacks when processing crafted SWF files (NVD, CVE Details).

The vulnerability exists due to the lack of boundary checks in the parseSWF_DEFINELOSSLESS2 function. When processing SWF files, the function fails to compare the size of 'end' and 'fileOffset' variables before calling readBytes. This can result in end-fileOffset becoming a negative integer, which is then treated as a large unsigned integer when passed to malloc, leading to memory allocation failures. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability can be exploited to cause denial-of-service conditions through memory allocation failures. When exploited, the application attempts to allocate an extremely large amount of memory, which leads to process termination (GitHub Issue).