Heap overflow in the GT2 loader of libmikmod 3.2.2
#######################################################################
Luigi Auriemma
Application: libmikmod
http://mikmod.raphnet.net
http://sourceforge.net/projects/mikmod/
Versions: <= 3.2.2 and current CVS
versions 2.x.x and all the others in which the GT2 file
format isn't implemented are not vulnerable
Platforms: Windows, POSIX, Mac
Bug: heap overflow in GT2's loadChunk
Exploitation: local
Date: 24 Jul 2006
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
libmikmod is a library mainly used by Mikmod for playing different
types of audio modules (669, amf, asy, dsm, far, gdm, gt2, imf, it,
m15, med, mod, mtm, okt, s3m, stm, stx, ult, uni and xm).
#######################################################################
======
2) Bug
======
GT2 is the GRAOUMF TRACKER module file format
(http://thorkildsen.no/faqsys/docs/gt2-form.txt).
During the handling of the XCOM chunk (a field which contains an extra
comment) libmikmod reads the 32 bit number which specifies the size of
the comment and then allocates an amount of memory equal to this value
plus one, probably for an optional but unused NULL byte at the end of
the comment.
The result is that the library allocates about zero bytes of memory
("about" since MikMod_malloc allocates 20 bytes more than the desired
size) if an attacker uses the value 0xffffffff (0xffffffff + 1 = 0) and
then tries to read the amount of memory specified by the size value
overflowing the allocated memory.
>From loaders/load_gt2.c:
GT_CHUNK *loadChunk(void)
...
if (!memcmp(new_chunk, "XCOM", 4)) {
new_chunk->xcom.chunk_size = _mm_read_M_ULONG(modreader);
new_chunk->xcom.comment_len = _mm_read_M_ULONG(modreader);
new_chunk->xcom.comment = MikMod_malloc(new_chunk->xcom.comment_len +
1);
_mm_read_UBYTES(new_chunk->xcom.comment, new_chunk->xcom.comment_len,
modreader);
return new_chunk;
}
...
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/lmmgt2ho.zip
#######################################################################
======
4) Fix
======
No fix.
No reply from the developers.
#######################################################################
---
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org