Përparim Mjeku

A heap buffer overflow occurs due to insufficient bounds checking. An attacker within radio range can exploit this to cause unexpected system termination. A heap buffer overflow is a memory corruption issue that happens when a program writes more data to a heap-allocated memory block than it can hold.

A heap buffer overflow occurs in the `start decoder()` function due to the truncation of the codebook multiplicands allocation size from `size t` to `int`. An attacker can exploit this by providing a specially crafted Ogg Vorbis file containing large entries and dimensions values, leading to out-of-bounds writes. This can result in heap corruption or process crashes.

An out-of-bounds read exists in the `pat smplooped()` function within `src/load pat.cpp`. The issue occurs because the function only validates the upper bound of the sample index against `MAXSMP` and subtracts one before indexing the `pat loops` static array. Consequently, if the `smpno` variable—which is initialized to zero and may not be overwritten before reaching the note test—is zero, the system reads one byte before the array. This process can be triggered by providing a specially crafted MIDI file to the `ModPlug Load` entry point, which then passes through `CSoundFile::Create`, `CSoundFile::ReadMID`, and `MID ReadPatterns`. The value read from the out-of-bounds memory determines if a note event is treated as looping, allowing adjacent static storage to influence the playback state.