| 标题 | vgmstream r2117 Stack-based Buffer Overflow |
|---|
| 描述 | vgmstream r2117 contains a CWE-121 vulnerability in the txth-txtp component. Crafted TXTH or TXTP text input can overwrite stack memory during media-file parsing, causing application termination and potentially enabling code execution in applications embedding vgmstream.
Affected component / root cause:
txth-txtp:sscanf-unbounded-scansets-to-fixed-stack-buffers
Technical details:
The TXTH and TXTP text parsers use unbounded sscanf() scansets to copy
attacker-controlled keys, values, and filenames into fixed-size stack buffers.
An overlong field therefore writes past the destination array before semantic
validation occurs. The proposed fix adds field widths matching the destination
buffers to every affected scanset.
Attacker-controlled data:
An attacker controls the bytes of a TXTH or TXTP text file; an overlong key, value, or TXTP filename crosses a fixed-size stack buffer boundary.
The minimized testcase has SHA-256 cd624ea92d99f1d3b48459ae1ca7573d1a049ff0b711594bc231586058562356. It reproduced
three times on the identified release and three times on the tested current
branch using AddressSanitizer and/or UndefinedBehaviorSanitizer. The linked
upstream issue contains the sanitizer harness, testcase, build instructions,
reproduction command, expected diagnostic output, and a proposed defensive
patch.
CWE: CWE-121
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| 来源 | ⚠️ https://github.com/vgmstream/vgmstream/issues/1972 |
|---|
| 用户 | ni-liao (UID 98297) |
|---|
| 提交 | 2026-07-29 07時52分 (1 月前) |
|---|
| 管理 | 2026-09-07 21時18分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 399668 [vgmstream 直到 r2117 txth-txtp src/meta/txth.c sscanf 内存损坏] |
|---|
| 积分 | 20 |
|---|