Description
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
swami libinstpatch
Default version status: unaffected
0 to ≤ 1.1.7affected
pkg:github/swami/libinstpatchReferences
- https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write ↗
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205 ↗
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370 ↗
- https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969 ↗
- https://github.com/swami/libinstpatch ↗
- https://www.vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-valid ↗