Description
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libgme game-music-emu
Default version status: unaffected
0 to ≤ 0.6.5affected
pkg:github/libgme/game-music-emuReferences
- https://hackmd.io/@haind-pwn/libgme-ay-track-table-underflow-oob-read ↗
- https://github.com/libgme/game-music-emu/blob/9e23d10f9fd2a6a2f33b10912dd8dc7153258995/gme/Nsf_Emu.cpp#L212-L218 ↗
- https://github.com/libgme/game-music-emu/blob/9e23d10f9fd2a6a2f33b10912dd8dc7153258995/gme/Classic_Emu.cpp#L66-L80 ↗
- https://github.com/libgme/game-music-emu/issues/164 ↗
- https://github.com/libgme/game-music-emu ↗
- https://www.vulncheck.com/advisories/game-music-emu-libgme-through-0.6.5-out-of-bounds-read-via-classic-emu-mute-voices ↗