Description
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tildearrow furnace
Default version status: unaffected
0 to ≤ 0.6.8.3affected
pkg:github/tildearrow/furnaceReferences
- https://github.com/tildearrow/furnace/issues/2966 ↗
- https://github.com/tildearrow/furnace ↗
- https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 ↗
- https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L981-L1017 ↗
- https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob ↗
- https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import ↗