Heap Out-of-Bounds Read in libTiMidity SoundFont Loader

Executive Summary

libTiMidity through 0.2.8 has a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c. It uses unvalidated sampleId and instrument generator values as table indices. Attackers can provide a crafted .sf2 file loaded via mid_set_soundfont() to read heap memory out of bounds and crash the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running libTiMidity versions 0.2.8 or below. Check for crashes when loading .sf2 files or examine logs for heap out-of-bounds read errors. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash the application or potentially access unauthorized memory by supplying a maliciously crafted .sf2 file. It may lead to denial-of-service conditions or information disclosure if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libTiMidity to a version beyond 0.2.8. If updating is not possible, avoid loading untrusted .sf2 files via mid_set_soundfont(). Restrict access to applications using libTiMidity to reduce exposure.

Useful 0 Not Useful 0