Nosefart denial of service vulnerability

["qflb.wu" <qflb.wu () dbappsecurity com cn>]

Nosefart denial of service vulnerability
================
Author : qflb.wu
===============


Introduction:
=============
Nosefart is NES Music Player.Nosefart plays NSF (Nintendo Entertainment System Sound Format) files so you can listen to 
those old tunes without actually having to play through the games.


Affected version:
=====
2.9-mls


Vulnerability Description:
==========================
the chk_mem_access function in src/cpu/nes6502/nes6502.c in libnosefart.a in Nosefart 2.9-mls can  cause a denial of 
service(invalid memory read and application crash) via a crafted nsf file.


./nosefart nosefart_2.9-mls_invalid_memory_read.nsf


Program received signal SIGSEGV, Segmentation fault.
0x0000000000401940 in chk_mem_access (
    access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
    at src/cpu/nes6502/nes6502.c:1195
1195  uint8 oldchk = * access;
(gdb) bt
#0  0x0000000000401940 in chk_mem_access (
    access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
    at src/cpu/nes6502/nes6502.c:1195
#1  0x0000000000401ad6 in _bank_readbyte (address=61962, flags=4 '\004')
    at src/cpu/nes6502/nes6502.c:1265
#2  0x00000000004022c2 in nes6502_execute (remaining_cycles=29823)
    at src/cpu/nes6502/nes6502.c:1549
#3  0x0000000000408630 in nsf_inittune (nsf=0x6222a0) at src/machine/nsf.c:309
#4  0x0000000000409adb in nsf_playtrack (nsf=0x6222a0, track=1, 
    sample_rate=44100, sample_bits=8, stereo=0 '\000') at src/machine/nsf.c:997
#5  0x00000000004106ee in nsf_setupsong () at src/linux/main_linux.c:403
#6  0x0000000000410be9 in play (
    filename=0x622030 "/home/a/Documents/file", track=1, doautocalc=0, 
    reps=0, starting_frame=0, limited=0) at src/linux/main_linux.c:534
#7  0x0000000000411122 in main (argc=2, argv=0x7fffffffdfc8)
    at src/linux/main_linux.c:690
(gdb) 


POC:
nosefart_2.9-mls_invalid_memory_read.nsf
CVE:
CVE-2017-11119




===============================




qflb.wu () dbappsecurity com cn

Attachment: poc.zip
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/