Description
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sezero libtimidity
Default version status: unaffected
0.2.8 to ≤ 0.2.8affected
References
- https://hackmd.io/@haind-pwn/libtimidity-soundfont-generator-oper-oob-write ↗
- https://github.com/sezero/libtimidity/blob/a52adf6aee2635e2a16797213a089c2180e67757/src/sndfont.c#L199-L224 ↗
- https://github.com/sezero/libtimidity ↗
- https://www.vulncheck.com/advisories/libtimidity-through-0.2.8-out-of-bounds-access-via-soundfont-preset-header ↗