Description
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mindwerks WildMIDI
Default version status: unaffected
0 to ≤ 0.5.0affected
pkg:github/Mindwerks/wildmidiReferences
- https://hackmd.io/@haind-pwn/wildmidi-hmp-chunk-length-underflow-oob-read ↗
- https://github.com/Mindwerks/wildmidi/blob/340472ed4633d139d30c660b90eca03c1320e593/src/f_hmi.c#L268-L290 ↗
- https://github.com/Mindwerks/wildmidi ↗
- https://www.vulncheck.com/advisories/wildmidi-through-0.5.0-heap-out-of-bounds-read-via-wm-parsenewhmi ↗