Bug#1002895: abcmidi: Stack based buffer overflow in the event_handle_instruction function used by abc2midi
Package: abcmidi
Version: 20211212-1
Severity: important
Tags: security
Dear Maintainer,
There is a stack based buffer overflow in the event_handle_instruction function from the store.c file used by abc2midi. The issues exists in the following code:
void event_handle_instruction(s)
/* handler for ! ! instructions */
/* does ppp pp p mp mf f ff fff */
/* also does !drum! and !nodrum! */
char* s;
{
char buff[MAXLINE]; // MAXLINE = 500
char* p;
char* q;
int done;
char midimsg[40];
[...]
if (done == 0 && quiet == -1) { /* [SS] 2013-11-02 */
sprintf(buff, "instruction !%s! ignored", s);
event_warning(buff);
};
As can be seen there is buff buffer with size 500. Later in the code sprintf is used to write data to this buffer without any boundary check. I wrote a small poc script for this in python:
#!/bin/python3
filecontent = b"""X:
K:C
+""" + b"A" * 600 + b"+"
f = open("poc.abc", "wb")
f.write(filecontent)
f.close()
This generates a poc.abc file. When executing the current version of abc2midi as follows this leads to a stack overflow:
$ abc2midi poc.abc -o /dev/null
4.64 December 12 2021 abc2midi
Error in line-char 0-0 : Missing Number
Warning in line-char 2-0 : No M: in header, using default
*** buffer overflow detected ***: terminated
Aborted
Locally I fixed this issue by using snprintf instead as follows:
if (done == 0 && quiet == -1) { /* [SS] 2013-11-02 */
snprintf(buff, MAXLINE, "instruction !%s! ignored", s);
event_warning(buff);
};
Best regards
Kolja
-- System Information:
Debian Release: 11.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages abcmidi depends on:
ii libc6 2.31-13+deb11u2
abcmidi recommends no packages.
Versions of packages abcmidi suggests:
pn abcm2ps <none>
ii evince [postscript-viewer] 3.38.2-1
pn timidity | pmidi <none>
-- no debconf information
Reply to: