CVE-2022-1289: Insufficient Information (NVD-CWE-noinfo)
value: A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2022-04-10T16:15Z
Repository: https://github.com/tildearrow/furnace
Language: C++
Files changed: src/gui/pattern.cpp
Commit date: 2022-04-09 18:25:38 -0500
Commit message: fix possible pattern crash

issue #325

Diff: diff --git a/src/gui/pattern.cpp b/src/gui/pattern.cpp
index d6b6fce7..d56196d6 100644
--- a/src/gui/pattern.cpp
+++ b/src/gui/pattern.cpp
@@ -280,31 +280,37 @@ inline void FurnaceGUI::patternRow(int i, bool isPlaying, float lineHeight, int
         // effect
         if (pat->data[i][index]==-1) {
           sprintf(id,"..##PE%d_%d_%d",k,i,j);
           ImGui::PushStyleColor(ImGuiCol_Text,inactiveColor);
         } else {
-          sprintf(id,"%.2X##PE%d_%d_%d",pat->data[i][index],k,i,j);
-          if (pat->data[i][index]<0x10) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[fxColors[pat->data[i][index]]]);
-          } else if (pat->data[i][index]<0x20) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
-          } else if (pat->data[i][index]<0x30) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_SECONDARY]);
-          } else if (pat->data[i][index]<0x48) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
-          } else if (pat->data[i][index]<0x90) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
-          } else if (pat->data[i][index]<0xa0) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_MISC]);
-          } else if (pat->data[i][index]<0xc0) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
-          } else if (pat->data[i][index]<0xd0) {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SPEED]);
-          } else if (pat->data[i][index]<0xe0) {
+          if (pat->data[i][index]>0xff) {
+            sprintf(id,"??##PE%d_%d_%d",k,i,j);
             ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
           } else {
-            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[extFxColors[pat->data[i][index]-0xe0]]);
+            const unsigned char data=pat->data[i][index];
+            sprintf(id,"%.2X##PE%d_%d_%d",data,k,i,j);
+            if (data<0x10) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[fxColors[data]]);
+            } else if (data<0x20) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
+            } else if (data<0x30) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_SECONDARY]);
+            } else if (data<0x48) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
+            } else if (data<0x90) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
+            } else if (data<0xa0) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_MISC]);
+            } else if (data<0xc0) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
+            } else if (data<0xd0) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SPEED]);
+            } else if (data<0xe0) {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
+            } else {
+              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[extFxColors[data-0xe0]]);
+            }
           }
         }
         ImGui::SameLine(0.0f,0.0f);
         if (cursorEffect) {
           ImGui::PushStyleColor(ImGuiCol_Header,uiColors[GUI_COLOR_PATTERN_CURSOR]);  

Vulnerable code:           sprintf(id,"%.2X##PE%d_%d_%d",pat->data[i][index],k,i,j);
          if (pat->data[i][index]<0x10) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[fxColors[pat->data[i][index]]]);
          } else if (pat->data[i][index]<0x20) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
          } else if (pat->data[i][index]<0x30) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_SECONDARY]);
          } else if (pat->data[i][index]<0x48) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
          } else if (pat->data[i][index]<0x90) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
          } else if (pat->data[i][index]<0xa0) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_MISC]);
          } else if (pat->data[i][index]<0xc0) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
          } else if (pat->data[i][index]<0xd0) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SPEED]);
          } else if (pat->data[i][index]<0xe0) {
            ImGui::PushStyleColor(ImGuiCol_Text,uiColors[extFxColors[pat->data[i][index]-0xe0]]);
Fixed code:           if (pat->data[i][index]>0xff) {
            sprintf(id,"??##PE%d_%d_%d",k,i,j);
            const unsigned char data=pat->data[i][index];
            sprintf(id,"%.2X##PE%d_%d_%d",data,k,i,j);
            if (data<0x10) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[fxColors[data]]);
            } else if (data<0x20) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
            } else if (data<0x30) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_SECONDARY]);
            } else if (data<0x48) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SYS_PRIMARY]);
            } else if (data<0x90) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
            } else if (data<0xa0) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_MISC]);
            } else if (data<0xc0) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
            } else if (data<0xd0) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_SPEED]);
            } else if (data<0xe0) {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[GUI_COLOR_PATTERN_EFFECT_INVALID]);
            } else {
              ImGui::PushStyleColor(ImGuiCol_Text,uiColors[extFxColors[data-0xe0]]);
            }