Description
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mmitch gbsplay
Default version status: unaffected
0 to ≤ 0.0.103affected
pkg:github/mmitch/gbsplayReferences
- https://github.com/mmitch/gbsplay/issues/201 ↗
- https://github.com/mmitch/gbsplay ↗
- https://github.com/mmitch/gbsplay/commit/91b1f6df0abd3914f91caa528ec3213d731999e8 ↗
- https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L996-L1010 ↗
- https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read ↗
- https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-vgm-open-in-gbs-c ↗