Description
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libxmp libxmp
Default version status: unaffected
0 to ≤ 4.7.4affected
pkg:github/libxmp/libxmpReferences
- https://hackmd.io/@haind-pwn/libxmp-p61a-sample-backreference-oob-read ↗
- https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L110-L116 ↗
- https://github.com/libxmp/libxmp/blob/5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da/src/loaders/prowizard/p61a.c#L638-L641 ↗
- https://github.com/libxmp/libxmp ↗
- https://www.vulncheck.com/advisories/libxmp-through-4.7.4-stack-out-of-bounds-read-via-p61a-depacker ↗