Integer Overflow in minimp3 APEv2 Tag Parsing

Executive Summary

This vulnerability is an integer overflow in the minimp3 library's mp3dec_skip_id3v1 function. It occurs when parsing the APEv2 tag-size field in an MP3 file. The code reads a 4-byte tag-size field and promotes each byte to a signed integer before left-shifting. If the most significant byte is 0x80 or higher, the left-shift operation causes a value exceeding INT_MAX, leading to undefined behavior in C. This triggers a process abort and denial of service when processing a crafted MP3 file.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan for MP3 files containing malformed APEv2 tags. Use tools like 'file' to inspect MP3 metadata or run minimp3-based applications with UndefinedBehaviorSanitizer (UBSan) enabled to catch integer overflows during parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) when processing a specially crafted MP3 file. If your application uses the minimp3 library and is built with UndefinedBehaviorSanitizer (UBSan) in a non-recovering mode, the application will immediately abort upon encountering the overflow, disrupting normal operation.

Useful 0 Not Useful 0

Mitigation Strategies

Update minimp3 to a patched version that validates APEv2 tag sizes or avoids signed left-shifts. If using the single-header file, replace it with a fixed version. Disable UBSan's unrecoverable mode or add input validation for APEv2 tags in MP3 parsers.

Useful 0 Not Useful 0