Heap Out-of-Bounds Read in WildMIDI HMP Parser

Executive Summary

WildMIDI through 0.5.0 has a heap out-of-bounds read flaw in the HMP parser function _WM_ParseNewHmp(). Attackers can exploit this by providing a maliciously crafted .hmp file with a chunk length between 0 and 12, which wraps around to about 4 GB. This causes the application to read beyond allocated memory buffers, potentially crashing the program or leaking sensitive heap data via WildMidi_GetInfo().

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running WildMIDI 0.5.0 or earlier for .hmp file processing. Check for crashes or unexpected behavior when handling HMP files. Use tools like file integrity monitors or debug logs to identify heap out-of-bounds reads during HMP parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash applications using WildMIDI, leading to denial-of-service conditions. It may also expose sensitive memory contents, potentially leaking confidential data. Users processing untrusted .hmp files are at risk of exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade WildMIDI to a version later than 0.5.0. If upgrading is not possible, restrict access to .hmp file processing or disable HMP support entirely. Monitor applications for crashes or memory leaks when handling HMP files.

Useful 0 Not Useful 0