Description
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Wohlstand libADLMIDI
Default version status: unaffected
1.6.2 to ≤ 1.6.2.1affected
References
- https://hackmd.io/@haind-pwn/libadlmidi-notestates-note-index-stack-oob ↗
- https://github.com/Wohlstand/libADLMIDI/blob/99c5e03a5cf9b4fdf35b53efddb853c96320d50f/src/midiseq/impl/read_smf_impl.hpp#L113 ↗
- https://github.com/Wohlstand/libADLMIDI/blob/99c5e03a5cf9b4fdf35b53efddb853c96320d50f/src/midiseq/impl/miditrack_impl.hpp#L350-L357 ↗
- https://github.com/Wohlstand/libADLMIDI ↗
- https://www.vulncheck.com/advisories/libadlmidi-1.6.2-through-1.6.2.1-stack-out-of-bounds-write-via-bw-midisequencer-notestates ↗