CVE-2017-1000418 (published 2018-01-02T18:29Z)

The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/Mindwerks/wildmidi
commit_details: repo_url: https://github.com/Mindwerks/wildmidi
author: sezero
author_date: 2017-08-04 10:15:00+03:00
msg: wildmidi_lib.c (WildMidi_Open, WildMidi_OpenBuffer): refuse to proceed if less then 18 bytes of input

Fixes bug #178.
repository: repo_url: https://github.com/Mindwerks/wildmidi
repo_name: Mindwerks/wildmidi
description: WildMIDI is a simple software midi player which has a core softsynth library that can be used with other applications.
repo_language: C
owner: Mindwerks
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ CHANGELOG
 0.4.2
 * Fixed CVE-2017-11661, CVE-2017-11662, CVE-2017-11663, CVE-2017-11664
   (Bug #175).
+* Fixed WildMidi_Open() might read beyond buffer with too short inputs
+  (Bug #178).
 * GUS patch processing changes to meet users expectations (Bug #132).
 * Worked around a build failure with newer FreeBSD versions failing to
   retrieve the ONLCR constant (Bug #171).

programming_language: Markdown
filename: wildmidi_lib.c
change_type: ModificationType.MODIFY
diff: @@ -1655,6 +1655,10 @@ WM_SYMBOL midi *WildMidi_Open(const char *midifile) {
     if ((mididata = (uint8_t *) _WM_BufferFile(midifile, &midisize)) == NULL) {
         return (NULL);
     }
+    if (midisize < 18) {
+        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
+        return (NULL);
+    }
     if (memcmp(mididata,"HMIMIDIP", 8) == 0) {
         ret = (void *) _WM_ParseNewHmp(mididata, midisize);
     } else if (memcmp(mididata, "HMI-MIDISONG061595", 18) == 0) {
@@ -1696,6 +1700,10 @@ WM_SYMBOL midi *WildMidi_OpenBuffer(uint8_t *midibuffer, uint32_t size) {
         _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_LONGFIL, NULL, 0);
         return (NULL);
     }
+    if (size < 18) {
+        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
+        return (NULL);
+    }
     if (memcmp(midibuffer,"HMIMIDIP", 8) == 0) {
         ret = (void *) _WM_ParseNewHmp(midibuffer, size);
     } else if (memcmp(midibuffer, "HMI-MIDISONG061595", 18) == 0) {

programming_language: C