Open
Description
Description
There is a potential vulnerability in the aubio_sampler_load function(src/synth.sampler.c) related to how the input URI string is copied into the o->uri buffer. The code allocates memory based on the length calculated by strnlen but uses strncpy in a way that can result in a non-null-terminated string under specific conditions.
// Inside aubio_sampler_load:
if (o->uri) AUBIO_FREE(o->uri);
o->uri = AUBIO_ARRAY(char_t, strnlen(uri, PATH_MAX));
strncpy(o->uri, uri, strnlen(uri, PATH_MAX));
o->source = new_aubio_source(o->uri, o->samplerate, o->blocksize);
// ...Impact:
When the potentially non-null-terminated o->uri is subsequently passed to functions that expect a standard C string, these functions might read past the end of the allocated buffer (o->uri) while searching for a null terminator.
Version
commit hash: dd9287c
Metadata
Metadata
Assignees
Labels
No labels