[mpg123-users] Security update mpg123 1.32.8: Frankenstein's Monster

[Thomas O. <tho...@or...>]

Dear mpg123 folks,

I hereby announce mpg123 version 1.32.8. Get it at the usual places.
Now.

This is an important security update! There is possible buffer overflow
(writing of decoded PCM samples beyond allocated output buffer) for
streams that change output properties together with certain usage of
libmpg123. This needed seeking around in the stream (including scanning
it before actual decoding) to trigger. So, your usual web radio stream
as obvious attack vector is unlikely, as you won't seek around in it.
If you do work with stream dumps, usage of MPG123_NO_FRANKENSTEIN or
the --no-frankenstein option to the mpg123 application is a workaround
to avoid the formerly dangerous situation in earlier mpg123 releases.
This also means that mpg123 will not decode streams of concatenated
files with either varying format or leading Info frames past the first
track anymore.

With this release, the parser has been improved not to store certain
stream properties before actual MPEG frame data matching that property
has been stored. This avoids the inconsistency that triggered the
overflow. Also note that if you always use a fixed decoding buffer for
full stereo of the maximum of 1152 samples per frame, times two and
your choice of encoding, your application is also not susceptible.

Exploitation of this is not trivial, but I cannot rule out the
possibility of gaining code execution. Your exploit payload needs to
pass through an MPEG decoder and PCM synth before possibly reaching the
CPU. Some heap corruption can follow at the least. So update or
mitigate. If you run 1.32.x, there is no excuse not to get the the
latest bugfix release now. 

Basically any version of mpg123 is affected by this, at least those
that explicitly support so-called Frankenstein streams.

Thanks to kkkkk123 for bringing this heir to the initial bug 322 to my
attention.

1.32.8
------
- libmpg123:
-- Add sections to assembly to support PAC/BTI code
   for aarch64 (-mbranch-protection variants), thanks to Bill Roberts
   (github PR 15).
-- Prevent premature application of header info into decoding structure,
   at worst having triggered out-of-bounds writes of decoded PCM data
   (bug 322, again).
- out123: Show --quiet in --longhelp.


Alrighty then,

Thomas