Description
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
adplug adplug
Default version status: unaffected
0 to ≤ 2.4affected
pkg:github/adplug/adplugReferences
- https://hackmd.io/@haind-pwn/adplug-ksm-note-loop-databuf-oob-write ↗
- https://github.com/adplug/adplug/blob/e491e382479ed2246f124c96c70d94561dce59b9/src/ksm.cpp#L99-L229 ↗
- https://github.com/adplug/adplug/issues/292 ↗
- https://github.com/adplug/adplug/pull/295 ↗
- https://github.com/adplug/adplug ↗
- https://www.vulncheck.com/advisories/adplug-through-2.4-heap-buffer-overflow-via-cksmplayer-update-in-ksm-cpp ↗