Dear all,
among lots of little fixes in the current 1.33.7 release of mpg123
(https://mpg123.org/#2026-08-02), there are some more serious security
issues that might be relevant for this list.
I'll include the full changes list below. To highlight some:
- The Windows port with enabled unicode path handling had a stupid
buffer overflow, possibly exploitable using remote playlists.
- OOB reads/writes for certain user-set parameters:
mpg123 --continue --random --listentry <n>
(where n > size of list)
out123 --endian <e> --channels <x> --inputch <y>
(where x != y)
out123 --filter "a,b ,c,…"
(whitespace before comma)
- Disclosure of uninitialized memory to servers via mpg123 --auth-file
(no line ends in file).
- Deadlock in mpg123 --buffer <n> -e s24
(for most values of n … only relevant if user chooses 24 bit encoding
and very reliable, so probably no surprise to anyone, but a DoS in
principle, if the encoding or buffer option is attacker-influenced)
There is a number of smaller and theoretical issues that you find when
you scan the code for possibilities (like size_t overflow in realloc).
The library APIs got some hardening against applications abusing them /
shooting themselves into the feet. It's amazing how many little
oversights accumulate, even if you thought you applied some care when
writing the code back then. I hope the LLM-assisted scanning doesn't
have that many more issues to find … as the supply of nights to devote
to the hobby on short notice is also not endless … (as you might notice
from the amount of typos in the list below).
I understand that CVEs for the more serious bugs are being requested by
reporter(s), but I do not have details and did not want to delay the
release.
1.33.7
------
- mpg123:
-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388,
thanks to Alejandro Ramos).
-- Fix information disclosure of uninitialied memory for --auth-file without
line endings. (bug 390, thanks to Alejandro Ramos)
-- Fix out-of-bounds read/write when combining --continue --random --listentry
<n>
where n is larger than the playlist size. (bug 391, thanks to Alejandro
Ramos)
-- Fix a harmless valgrind memory leak report by not nulling playlist name.
-- Fix error handling of win32_net_writestring() (Windows only) by actually
using
a signed type, also preventing a OOB read on failure.
(bug 392 by Alejandro Ramos)
-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics.
(bug 392)
-- Fix leaking file descriptor on read error from --equalizer file. (bug 392)
-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including
the -- separator. No actual vulnerability, tough, just extra care. (bug 392)
- out123:
-- Fix heap overrun on --endian conversion with differing input and output
channel counts. (bug 391)
-- Fix parsing of filter specs with whitespace before commas, which resulted
in out-of-bounds writes before. (bug 391)
- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow
of size_t in arguments. Specifically, this addresses part of bug 389 with
possible
application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos)
- libmpg123:
-- Fix possible use of uninitialized values in layer III dequantization.
III_dequantize_sample() for consistent output also for strange input. The new
code seems to be slightly faster after some rearrangements.
(thanks to He Huang, Swinburne University of Technology (discovered using
NexusSan))
-- Fix a double free when deleting a handle after failed mpg123_decoder() call
(possibly among others). (bug 389)
-- More strong wording in API that ID3 text convenience links are short-lived,
but safeguard against ignorant use by nulling them early.
(bug 389)
-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with
index size 0. (bug 392)
-- Harden against an application wielding a foot gun by handing in an undersized
decoding buffer betwee seek and read (return error before trying to decode
and discard frames in that case). (bug 392)
-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they
overwrite
previous frames, like with other encodings. The symptom was a shorter second
frame resulting in a combined text with the earlier longer frame.
(bug 392)
-- Check and properly handle null source buffer and zero size in
mpg123_store_utf8()
instead of reading past (before) buffers. (bug 392)
-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw()
only if the parser decided that it is there, not possibly the last 128 bytes
of
a seekable stream without ID3v1 tag. (bug 392)
-- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which
would trgger endless looping. (bug 392)
- libout123:
-- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now
also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392)
-- Abort early on zero/negative rate and channel count in out123_start().
(bug 392)
-- Fix divide by zero in WAV writing by catching channel counts that go zero in
the
16 bit WAV header field. (bug 392)
- libsyn123:
-- Explictly reject mismatched format for appending filters with
syn123_setup_filter(), preventing memory errors from that API-violating use.
(bug 392)
-- Harden the dirty resampling interpolator against extreme rates (around 1e18
Hz)
by fixing a sample offset check to not do the exact overflowing addition
that it is supposed to guard against. The fine resampler was … fine. (bug
392)
-- Error out on trying to create a filter of order 0 instead of dividing by zero
later. (bug 392)
Alrighty then (or not),
Thomas
--
Dr. Thomas Orgis
HPC @ Universität Hamburg
