Description
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
vgmstream vgmstream
Default version status: unaffected
0 to ≤ r2117affected
References
- https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read ↗
- https://github.com/vgmstream/vgmstream/blob/71e2361042531fe767fb98300cf8c1ee95e539a0/src/coding/libs/g7221_lib.c#L838 ↗
- https://github.com/vgmstream/vgmstream ↗
- https://www.vulncheck.com/advisories/vgmstream-through-r2117-stack-out-of-bounds-read-via-g-722.1-siren14-decoder ↗