Description
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sezero libtimidity
Default version status: unaffected
0.2.8 to ≤ 0.2.8affected
References
- https://hackmd.io/@haind-pwn/libtimidity-soundfont-generator-oper-oob-write ↗
- https://github.com/sezero/libtimidity/blob/a52adf6aee2635e2a16797213a089c2180e67757/src/sndfont.c#L468-L480 ↗
- https://github.com/sezero/libtimidity ↗
- https://www.vulncheck.com/advisories/libtimidity-through-0.2.8-stack-out-of-bounds-write-via-parse-gen-in-soundfont-loader ↗