Description
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sezero libtimidity
Default version status: unaffected
0.2.8 to ≤ 0.2.8affected
References
- https://hackmd.io/@haind-pwn/libtimidity-soundfont-generator-oper-oob-write ↗
- https://github.com/sezero/libtimidity/blob/a52adf6aee2635e2a16797213a089c2180e67757/src/sndfont.c#L578-L590 ↗
- https://github.com/sezero/libtimidity ↗
- https://www.vulncheck.com/advisories/libtimidity-through-0.2.8-out-of-bounds-read-via-soundfont-loader-sndfont-c ↗