SWFTools as free software for SWF generation

[ousia]

[This comes from swftools/swftools#231, opened by @ROBERT-MCDOWELL.]

SWFTools (https://swftools.org) is a project that includes the following binaries:

1. as3compile: an AS3 compiler.
2. font2swf: converts a font to SWF.
3. gif2swf, jpeg2swf, png2swf: image to SWF converters.
4. pdf2swf: PDF file to SWF converter.
5. swfc: compiles SWF scripts into SWF files (AS2 too).
6. swfdump: displays the content of SWF files.
7. wav2swf: converts WAV to SWF.
8. swfbbox: plays with bounding boxes.
9. swfrender: renders SWF file in PNG format.
10. swfextract: extracts data from SWF files.
11. swfstrings: extracts strings from SWF files.
12. swfcombine: combines SWF files.

Matthias Kramm was its main developer and he did a wonderful job maintaining this software for years.

But as life goes on, he had other things to do (which is perfectly fine) and SWFTools has been unmaintained for over a decade.

Many Linux distributions include SWFTools (and also HomeBrew [among other ones]).

Besides segmentation faults and new features it would be nice to have, the main problem is that SWFTools have a non-negligible number of common vulnerabilities (more than a hundred, according to https://nvd.nist.gov/vuln/search/results?query=swftools&search_type=all).

I wonder whether sheltering SWFTools under the Ruffle umbrella could help both projects, further developing the former and including a free (as in “free speech” tool) to generate and modify SWF animations.

I am aware that this would mean other project to take care of and that implies investing time in it.

My question is whether SWFTools could be the project that Ruffle shelters to generate and modify SWF animations.

Many thanks for your excellent work, your patience (reading this) and your help.

[ousia]

Is there any chance to get a reply, even if the idea is totally rejected?

I understand that there is too much code for so few people.

SWFTools are written mainly in C (and porting them to Rust would be also an extra effort).

Licensing terms are also different (GNU GPLv2).

As far as I can remember, I read that Ruffle aims to have software for writing and dealing with SWF animations.

May SWFTools be considered as the tool this project can adopt or should this idea be totally discarded?

Many thanks for your help.

[ROBERT-MCDOWELL]

@ousia I don't really understand why you would like to convert swftools in rust knowing than ruffle needs SWF to play it?
so if you create a SWF files with swftools Ruffle can play it as long as the functions used are already implemented

[ousia]

Sorry, I don’t like SWFTools rewritten in Rust. I only intend these to be maintained.

I only thought that coding in Rust would be more natural for the people contributing code to Ruffle.

I see what might be the cause of misunderstanding here: I know that the programming language of players and SWF animations doesn’t have to be the same.

Many thanks for your reply.

[ROBERT-MCDOWELL]

@ousia Motivate developers here knowing enough C language to maintained SWFtools would be a good thing at its best, especially since SWFtools is still in standard package for many Linux distrib. What I know is some distrib like Fedora fixed it to let them compile and package it, so maybe start to get the rpm sources and make diffs of what it changed then create a fork or a PR right to Matthias repo.

[adrian17]

Is there any chance to get a reply, even if the idea is totally rejected?

Sorry for taking long to respond.

OK, here's my opinion:

Unfortunately, I don't think we have the resources to take this. This is a huge blob of C, written in a way that currently - even from C's POV, and sorry for being very direct - looks like it's asking for memory bugs. I also asked around and I think most of our devs (with some exceptions) have never actually used this toolkit; even if we had resources, it'd be weird to maintain something we never really use ourselves.

Further, from my perspective, https://github.com/jindrapetrik/jpexs-decompiler already has a lot of the features that swftools has (at least, the SWF dumping/extraction, and AS2/3 modification), while supporting much more of newer SWF versions. Maybe you could have some success trying to migrate to that? The remaining features sound like could be somewhat integrated as feature requests into either Ruffle or FFDEC individually.

[adrian17]

Side note:

SWFTools have a non-negligible number of common vulnerabilities (more than a hundred

Looks like someone just went wild with a fuzzing tool :) It's entirely possible you could find another hundred with another round of fuzzing; it appears that SWFTools just wasn't written to recover from malformed SWFs at all.

[ousia]

Sorry for taking long to respond.

Many thanks for your reply, @adrian17.

[…] I also asked around and I think most of our devs (with some exceptions) have never actually used this toolkit; even if we had resources, it'd be weird to maintain something we never really use ourselves.

Of course, it would make no sense to maintain anything that you don’t really use.

Further, from my perspective, https://github.com/jindrapetrik/jpexs-decompiler already has a lot of the features that swftools has (at least, the SWF dumping/extraction, and AS2/3 modification), while supporting much more of newer SWF versions.

SWFTools hasn’t been actively developed for more than a decade. This is also the reason with FFDEC has more recent versions.

Maybe you could have some success trying to migrate to that? The remaining features sound like could be somewhat integrated as feature requests into either Ruffle or FFDEC individually.

Sorry, but I need to generate (rather than modify) SWF files.

This would be require converting PDF into SWF and a SWF compiler. As far as I know, neither Ruffle nor FFDEC have any of these features.

I think I read from @Herschel (a long while ago, so I may be recalling a non-existing memory 😅) that Ruffle would have a tool to generate SWF files.

Could any from these features added to Ruffle?

Many thanks for your help.