libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the consuming process.

A stack-based buffer overflow vulnerability was discovered [1] in the way that that libmodplug handled S3M media files. If an attacker were able to coerce a user into opening a malicious S3M media file with an application linked to libmodplug, it could be possible to execute arbitrary code with the privileges of the user running the application.

This has been corrected upstream [2] in 0.8.8.2

[1] https://www.sec-consult.com/files/20110407-0libmodplugstackoverflow.txt [2] http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b