Description
dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mackron dr_libs dr_flac.h
Default version status: unknown
0 to ≤ 0.13.3affectedfefced4a64adfb1a68a2d31d882366e56096dee8unaffected4f5a4cd3b57564d969443c580c75857e039f100aunaffected663239a3d0460c33bd5b6e5166edcb404e3df676unaffected
pkg:github/mackron/dr_libsReferences
- https://github.com/mackron/dr_libs/issues/298 ↗
- https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8 ↗
- https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a ↗
- https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676 ↗
- https://www.vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing ↗