New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Multiple heap-based buffer overflows in CradLoader::load() #89
Labels
Comments
|
This issue has been assigned CVE-2019-14733. |
miller-alex
added a commit
to miller-alex/adplug
that referenced
this issue
Apr 3, 2020
While fuzzing AdPlug with American Fuzzy Lop, Frederic Cambus found several memory issues and reported them on github. Hook up the reproducers he provided as test cases in stresstest.cpp. This includes tests for the following github issues: * Issue adplug#85 ("Heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream()") * Issue adplug#86 ("Heap-based buffer overflow in CdtmLoader::load()") * Issue adplug#87 ("Heap-based buffer overflow in CmkjPlayer::load()") * Issue adplug#88 ("Multiple heap-based buffer overflows in Ca2mLoader::load()") * Issue adplug#89 ("Multiple heap-based buffer overflows in CradLoader::load()") * Issue adplug#90 ("Multiple heap-based buffer overflows in CmtkLoader::load()") * Issue adplug#91 ("Double free in Cu6mPlayer::~Cu6mPlayer()") Co-authored-by: Frederic Cambus <fred@statdns.com> Bug: adplug#85 Bug: adplug#86 Bug: adplug#87 Bug: adplug#88 Bug: adplug#89 Bug: adplug#90 Bug: adplug#91
miller-alex
added a commit
to miller-alex/adplug
that referenced
this issue
Apr 3, 2020
This patches several memory issues while loading .rad files in src/rad.cpp: * Simplify the code reading the descrition and ensure not to write past the end of "desc". * Add several checks for errors reading the file and fail loading in that case. * Check instument number before using it as index to the "inst" array to avoid an out-of bounds write. * Check order length before writing data to the array. Fixes a heap-based buffer overflow (issue adplug#89). * Check channel and row numbers before using them as indices for writing track data. Fixes another buffer overflow (issue adplug#89). This fixes CVE-2019-14733. Fixes: adplug#89
Malvineous
pushed a commit
that referenced
this issue
May 11, 2020
While fuzzing AdPlug with American Fuzzy Lop, Frederic Cambus found several memory issues and reported them on github. Hook up the reproducers he provided as test cases in stresstest.cpp. This includes tests for the following github issues: * Issue #85 ("Heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream()") * Issue #86 ("Heap-based buffer overflow in CdtmLoader::load()") * Issue #87 ("Heap-based buffer overflow in CmkjPlayer::load()") * Issue #88 ("Multiple heap-based buffer overflows in Ca2mLoader::load()") * Issue #89 ("Multiple heap-based buffer overflows in CradLoader::load()") * Issue #90 ("Multiple heap-based buffer overflows in CmtkLoader::load()") * Issue #91 ("Double free in Cu6mPlayer::~Cu6mPlayer()") Co-authored-by: Frederic Cambus <fred@statdns.com> Bug: #85 Bug: #86 Bug: #87 Bug: #88 Bug: #89 Bug: #90 Bug: #91
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
While fuzzing AdPlug with American Fuzzy Lop, I found multiple heap-based buffer overflows in CradLoader::load(), in src/rad.cpp L74 and L85.
Attaching reproducers for both issues (gzipped so GitHub accepts them):
The text was updated successfully, but these errors were encountered: