Description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Konstanty Bialkowski libmodplug
Default version status: unaffected
0 to ≤ 0.8.9.1affected
pkg:github/Konstanty/libmodplugReferences
- https://github.com/Konstanty/libmodplug/issues/103 ↗
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_pat.cpp#L213-L217 ↗
- https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_mid.cpp#L829 ↗
- https://github.com/Konstanty/libmodplug ↗
- https://www.vulncheck.com/advisories/libmodplug-out-of-bounds-read-in-pat-smplooped-via-crafted-midi-file ↗