Përparim Mjeku

يحدث تجاوز في ذاكرة التخزين المؤقت للكومة (heap buffer overflow) بسبب عدم كفاية التحقق من الحدود. يمكن للمهاجم الموجود ضمن نطاق الراديو استغلال ذلك للتسبب في إنهاء النظام بشكل غير متوقع. تجاوز ذاكرة التخزين المؤقت للكومة هو مشكلة فساد في الذاكرة تحدث عندما يكتب البرنامج بيانات في كتلة ذاكرة مخصصة في الكومة أكثر مما يمكنها استيعابه.

A heap buffer overflow occurs in the `start decoder()` function due to the truncation of the codebook multiplicands allocation size from `size t` to `int`. An attacker can exploit this by providing a specially crafted Ogg Vorbis file containing large entries and dimensions values, leading to out-of-bounds writes. This can result in heap corruption or process crashes.

An out-of-bounds read exists in the `pat smplooped()` function within `src/load pat.cpp`. The issue occurs because the function only validates the upper bound of the sample index against `MAXSMP` and subtracts one before indexing the `pat loops` static array. Consequently, if the `smpno` variable—which is initialized to zero and may not be overwritten before reaching the note test—is zero, the system reads one byte before the array. This process can be triggered by providing a specially crafted MIDI file to the `ModPlug Load` entry point, which then passes through `CSoundFile::Create`, `CSoundFile::ReadMID`, and `MID ReadPatterns`. The value read from the out-of-bounds memory determines if a note event is treated as looping, allowing adjacent static storage to influence the playback state.