Description
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ValleyBell libvgm
Default version status: unaffected
0 to ≤ a6eed945ecf4e5a25cf82004779c6f7e4fd5c319affected
References
- https://hackmd.io/@haind-pwn/libvgm-pcm-compression-table-oob-read ↗
- https://github.com/ValleyBell/libvgm/blob/a6eed945ecf4e5a25cf82004779c6f7e4fd5c319/player/dblk_compr.c#L727-L751 ↗
- https://github.com/ValleyBell/libvgm/blob/a6eed945ecf4e5a25cf82004779c6f7e4fd5c319/player/dblk_compr.c#L183-L190 ↗
- https://github.com/ValleyBell/libvgm ↗
- https://www.vulncheck.com/advisories/valleybell-libvgm-through-commit-a6eed945-heap-out-of-bounds-read-via-decompressdatablk ↗