| Título | vgmstream r2117 Resource Consumption |
|---|
| Descrição | vgmstream r2117 (commit 71e2361042531fe767fb98300cf8c1ee95e539a0; vulnerable loop introduced in b9bea931a88b10f6ca2feb0ac5b37e6b4388d428) contains a CWE-400 vulnerability in the txtp component. A crafted TXTP playlist can force excessive memory allocation and quadratic entry-array growth before audio decoding, terminating or stalling the embedding application.
Affected component / root cause:
txtp:add_entry-unbounded-attacker-controlled-range-with-five-entry-realloc-growth
Technical details:
Trigger
TXTP files can select an inclusive subsong range with syntax such as
file.ext#1~10. The minimized harness input is 16 bytes and represents a TXTP
entry whose upper bound is 2147483647.
parse_params() stores the attacker-controlled bounds in range_start and
range_end. add_entry() then creates one txtp_entry_t for every value in
that interval. The vulnerable implementation has no range or cumulative-entry
limit and grows the array by only five elements for each realloc().
Consequently, a tiny input can request billions of entries. The repeated
allocation and copying also makes construction quadratic in the number of
entries. Under a 512 MiB virtual-memory limit, the 16-byte testcase reached
516,816 KiB maximum resident set size in 0.42 seconds before allocation failed.
A smaller #1~611 range reliably exceeded the one-second execution limit on
both tested revisions.
Security impact
An attacker who can cause an application to open an untrusted TXTP playlist can
force excessive memory allocation and CPU consumption before any referenced
audio file is decoded. This can terminate or stall the host media player,
conversion service, indexing process, or other application embedding
vgmstream.
No memory corruption or code-execution primitive has been demonstrated for
this root cause.
Affected versions
- Release r2117, commit 71e2361042531fe767fb98300cf8c1ee95e539a0:
reproduced 3/3 times.
- Main commit c01f584b97c5f4567f49022872ba967ebf03917d:
reproduced 3/3 times.
- The vulnerable five-entry growth loop was introduced by commit
b9bea931a88b10f6ca2feb0ac5b37e6b4388d428 on July 27, 2024.
Remediation rationale
The candidate patch rejects invalid or oversized ranges, limits both individual
and cumulative TXTP entries to the existing VGMSTREAM_MAX_SUBSONGS ceiling,
and allocates the required capacity once instead of repeatedly growing by five.
The independently patched release and main builds both reject the minimized
large-range input without timing out.
Attacker-controlled data:
The attacker controls the TXTP subsong range bounds. A 16-byte harness input requests 2,147,483,647 entries; a 611-entry range already exceeds the one-second execution limit.
The minimized testcase has SHA-256 99a4127b67790888679cd3f0088622139cd456005f71797ac64287e1d48a196f. It reproduced
three times on the identified release and three times on the tested current
branch with the same decode harness used during validation. The linked
upstream issue contains the harness, testcase, build instructions,
reproduction command, expected resource-exhaustion behavior, and a proposed
defensive patch.
CWE: CWE-400
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
|---|
| Fonte | ⚠️ https://github.com/vgmstream/vgmstream/issues/1973 |
|---|
| Utilizador | ni-liao (UID 98297) |
|---|
| Submissão | 29/07/2026 07h54 (há 1 mês) |
|---|
| Moderação | 07/09/2026 21h18 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 399669 [vgmstream até r2117 txtp src/meta/txtp_parser.c add_entry range_start/range_end Negação de Serviço] |
|---|
| Pontos | 20 |
|---|