CVE-2017-1000418: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2018-01-02T18:29Z
Repository: https://github.com/Mindwerks/wildmidi
Language: C
Files changed: README.md, src/wildmidi_lib.c
Commit date: 2017-08-04 10:15:00 +0300
Commit message: wildmidi_lib.c (WildMidi_Open, WildMidi_OpenBuffer): refuse to proceed if less then 18 bytes of input

Fixes bug #178.

Diff: diff --git a/README.md b/README.md
index bc0ea32..8268474 100644
--- a/README.md
+++ b/README.md
@@ -36,10 +36,12 @@ Requirements:
 CHANGELOG
 
 0.4.2
 * Fixed CVE-2017-11661, CVE-2017-11662, CVE-2017-11663, CVE-2017-11664
   (Bug #175).
+* Fixed WildMidi_Open() might read beyond buffer with too short inputs
+  (Bug #178).
 * GUS patch processing changes to meet users expectations (Bug #132).
 * Worked around a build failure with newer FreeBSD versions failing to
   retrieve the ONLCR constant (Bug #171).
 * Fixed a minor Windows unicode issue (PR #170).
 * A few other fixes / clean-ups.
diff --git a/src/wildmidi_lib.c b/src/wildmidi_lib.c
index 15c1bb1..3842e90 100644
--- a/src/wildmidi_lib.c
+++ b/src/wildmidi_lib.c
@@ -1653,10 +1653,14 @@ WM_SYMBOL midi *WildMidi_Open(const char *midifile) {
     }
 
     if ((mididata = (uint8_t *) _WM_BufferFile(midifile, &midisize)) == NULL) {
         return (NULL);
     }
+    if (midisize < 18) {
+        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
+        return (NULL);
+    }
     if (memcmp(mididata,"HMIMIDIP", 8) == 0) {
         ret = (void *) _WM_ParseNewHmp(mididata, midisize);
     } else if (memcmp(mididata, "HMI-MIDISONG061595", 18) == 0) {
         ret = (void *) _WM_ParseNewHmi(mididata, midisize);
     } else if (memcmp(mididata, mus_hdr, 4) == 0) {
@@ -1694,10 +1698,14 @@ WM_SYMBOL midi *WildMidi_OpenBuffer(uint8_t *midibuffer, uint32_t size) {
     if (size > WM_MAXFILESIZE) {
         /* don't bother loading suspiciously long files */
         _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_LONGFIL, NULL, 0);
         return (NULL);
     }
+    if (size < 18) {
+        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
+        return (NULL);
+    }
     if (memcmp(midibuffer,"HMIMIDIP", 8) == 0) {
         ret = (void *) _WM_ParseNewHmp(midibuffer, size);
     } else if (memcmp(midibuffer, "HMI-MIDISONG061595", 18) == 0) {
         ret = (void *) _WM_ParseNewHmi(midibuffer, size);
     } else if (memcmp(midibuffer, mus_hdr, 4) == 0) {

Fixed code: * Fixed WildMidi_Open() might read beyond buffer with too short inputs
  (Bug #178).
    if (midisize < 18) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
        return (NULL);
    }
    if (size < 18) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
        return (NULL);
    }