| タイトル | vgmstream r2117 Use After Free |
|---|
| 説明 | vgmstream contains a CWE-416 vulnerability in make_group_random() in src/meta/txtp_process.c. The function can move the selected stream into the shared list with update_vgmstream_list(), then call make_group_segment() on that stream. If segment creation fails, the selected object may already have been freed by the callee, but the caller still reaches the shared fail path and closes the stale local pointer again. A crafted TXTP file can therefore trigger a use-after-free during random-group failure cleanup, causing process termination and potentially enabling further memory corruption.
I re-verified this issue against the latest upstream HEAD commit 79bc65b52cddc61b859679c1c47dc57092872ae1 on 2026-08-21 and confirmed that the vulnerable logic is still present there.
Affected component / root cause: txtp:random-group-failed-segment-transfer-double-closes-selected-stream
CWE: CWE-416
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| ソース | ⚠️ https://github.com/vgmstream/vgmstream/issues/1998 |
|---|
| ユーザー | ni-liao (UID 98297) |
|---|
| 送信 | 2026年09月13日 16:31 (22 日 ago) |
|---|
| モデレーション | 2026年10月04日 19:37 (21 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413456 [vgmstream 迄 r2117 TXTP File src/meta/txtp_process.c make_group_random メモリ破損] |
|---|
| ポイント | 20 |
|---|