New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Heap-based buffer overflow in CdtmLoader::load() #86
Labels
Comments
|
This issue has been assigned CVE-2019-14691. |
miller-alex
added a commit
to miller-alex/adplug
that referenced
this issue
Apr 3, 2020
While fuzzing AdPlug with American Fuzzy Lop, Frederic Cambus found several memory issues and reported them on github. Hook up the reproducers he provided as test cases in stresstest.cpp. This includes tests for the following github issues: * Issue adplug#85 ("Heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream()") * Issue adplug#86 ("Heap-based buffer overflow in CdtmLoader::load()") * Issue adplug#87 ("Heap-based buffer overflow in CmkjPlayer::load()") * Issue adplug#88 ("Multiple heap-based buffer overflows in Ca2mLoader::load()") * Issue adplug#89 ("Multiple heap-based buffer overflows in CradLoader::load()") * Issue adplug#90 ("Multiple heap-based buffer overflows in CmtkLoader::load()") * Issue adplug#91 ("Double free in Cu6mPlayer::~Cu6mPlayer()") Co-authored-by: Frederic Cambus <fred@statdns.com> Bug: adplug#85 Bug: adplug#86 Bug: adplug#87 Bug: adplug#88 Bug: adplug#89 Bug: adplug#90 Bug: adplug#91
miller-alex
added a commit
to miller-alex/adplug
that referenced
this issue
Apr 3, 2020
There are several issues when loading .dtm files which can lead to invalid memory accesses. This patch fixes the following: * In CdtmLoader::load(), ensure that title and author strings are properly terminated to avoid out-of-bounds reads. * Check that the number of instruments is valid. This avoids a heap-based buffer overflow (see issue adplug#86). * Reading the description string could overflow a stack buffer by 1 byte and write past the end of the array into an adjacent class member (which is only initialized later). Get rid of the stack buffer and truncate the description if necessary. * Fail loading when an error is detected while trying to read data from the file or while decoding RLE data. * Check the argument of CdtmLoader::getinstrument() to avoid out-of-bound accesses. This fixes CVE-2019-14691. Fixes: adplug#86
Malvineous
pushed a commit
that referenced
this issue
May 11, 2020
While fuzzing AdPlug with American Fuzzy Lop, Frederic Cambus found several memory issues and reported them on github. Hook up the reproducers he provided as test cases in stresstest.cpp. This includes tests for the following github issues: * Issue #85 ("Heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream()") * Issue #86 ("Heap-based buffer overflow in CdtmLoader::load()") * Issue #87 ("Heap-based buffer overflow in CmkjPlayer::load()") * Issue #88 ("Multiple heap-based buffer overflows in Ca2mLoader::load()") * Issue #89 ("Multiple heap-based buffer overflows in CradLoader::load()") * Issue #90 ("Multiple heap-based buffer overflows in CmtkLoader::load()") * Issue #91 ("Double free in Cu6mPlayer::~Cu6mPlayer()") Co-authored-by: Frederic Cambus <fred@statdns.com> Bug: #85 Bug: #86 Bug: #87 Bug: #88 Bug: #89 Bug: #90 Bug: #91
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
While fuzzing AdPlug with American Fuzzy Lop, I found a heap-based buffer overflow in CdtmLoader::load(), in src/dtm.cpp L101.
Attaching a reproducer (gzipped so GitHub accepts it): test01.dtm.gz
The text was updated successfully, but these errors were encountered: