Përparim Mjeku

stb vorbis through 1.22 contains a heap buffer overflow in start decoder() where the codebook multiplicands allocation size is truncated from size t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

**Name of the Vulnerable Software and Affected Versions** libmodplug versions prior to 0.8.9.2 **Description** An out-of-bounds read exists in the `pat smplooped()` function within `src/load pat.cpp`. The issue occurs because the function only validates the upper bound of the sample index against `MAXSMP` and subtracts one before indexing the `pat loops` static array. Consequently, if the `smpno` variable—which is initialized to zero and may not be overwritten before reaching the note test—is zero, the system reads one byte before the array. This process can be triggered by providing a specially crafted MIDI file to the `ModPlug Load` entry point, which then passes through `CSoundFile::Create`, `CSoundFile::ReadMID`, and `MID ReadPatterns`. The value read from the out-of-bounds memory determines if a note event is treated as looping, allowing adjacent static storage to influence the playback state. **Recommendations** Update libmodplug to version 0.8.9.2 or later.