Description
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
adplug adplug
Default version status: unaffected
0 to ≤ 2.4affected
pkg:github/adplug/adplugReferences
- https://hackmd.io/@haind-pwn/adplug-ksm-note-loop-databuf-oob-write ↗
- https://github.com/adplug/adplug/blob/e491e382479ed2246f124c96c70d94561dce59b9/src/dmo.cpp#L56-L78 ↗
- https://github.com/adplug/adplug ↗
- https://www.vulncheck.com/advisories/adplug-through-2.4-heap-out-of-bounds-read-via-cdmoloader-load ↗