Nosefart denial of service vulnerability
================
Author : qflb.wu
===============
Introduction:
=============
Nosefart is NES Music Player.Nosefart plays NSF (Nintendo Entertainment System
Sound Format) files so you can listen to those old tunes without actually
having to play through the games.
Affected version:
=====
2.9-mls
Vulnerability Description:
==========================
the chk_mem_access function in src/cpu/nes6502/nes6502.c in libnosefart.a in
Nosefart 2.9-mls can cause a denial of service(invalid memory read and
application crash) via a crafted nsf file.
./nosefart nosefart_2.9-mls_invalid_memory_read.nsf
Program received signal SIGSEGV, Segmentation fault.
0x0000000000401940 in chk_mem_access (
access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
at src/cpu/nes6502/nes6502.c:1195
1195 uint8 oldchk = * access;
(gdb) bt
#0 0x0000000000401940 in chk_mem_access (
access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
at src/cpu/nes6502/nes6502.c:1195
#1 0x0000000000401ad6 in _bank_readbyte (address=61962, flags=4 '\004')
at src/cpu/nes6502/nes6502.c:1265
#2 0x00000000004022c2 in nes6502_execute (remaining_cycles=29823)
at src/cpu/nes6502/nes6502.c:1549
#3 0x0000000000408630 in nsf_inittune (nsf=0x6222a0) at src/machine/nsf.c:309
#4 0x0000000000409adb in nsf_playtrack (nsf=0x6222a0, track=1,
sample_rate=44100, sample_bits=8, stereo=0 '\000') at src/machine/nsf.c:997
#5 0x00000000004106ee in nsf_setupsong () at src/linux/main_linux.c:403
#6 0x0000000000410be9 in play (
filename=0x622030 "/home/a/Documents/file", track=1, doautocalc=0,
reps=0, starting_frame=0, limited=0) at src/linux/main_linux.c:534
#7 0x0000000000411122 in main (argc=2, argv=0x7fffffffdfc8)
at src/linux/main_linux.c:690
(gdb)
POC:
nosefart_2.9-mls_invalid_memory_read.nsf
CVE:
CVE-2017-11119
===============================
qflb.wu () dbappsecurity com cn
Attachment:
poc.zip
Description: Zip compressed data
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/