Summary

An out-of-bounds array access can occur in track_set_index.

Details

The function track_set_index does not check that i >= 0:

void track_set_index(Track *track, int i, long ind)
{
	if (i > MAXINDEX) {
		fprintf(stderr, "too many indexes\n");
                return;
        }

	track->index[i] = ind;
}

If i is negative, then this code can write to an address outside the bounds of the array.

The value of i is parsed using atoi in cue_scanner.l:

[[:digit:]]+	{ yylval.ival = atoi(yytext); return NUMBER; }

atoi does not check for integer overflow, so it is easy to get it produce a negative number.

PoC

This is an example CUE file which triggers the bug:

FILE pwned.mp3 MP3
TRACK 000 AUDIO
INDEX 4294567296 0

The index 4294567296 is converted to -400000 by atoi.

Impact

This issue may lead to code execution when libcue is used to parse a malicious file.