An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faadresetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffersize - words4, cast to uint32. If ld->buffer_size - words4 is negative, a buffer overflow is later performed via getdwordn(&ld->start[words], ld->bytesleft).
{ "vanir_signatures": [ { "digest": { "function_hash": "124005640876210091824677984462777690187", "length": 745.0 }, "id": "CVE-2019-15296-4aefd7e4", "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174", "signature_type": "Function", "signature_version": "v1", "target": { "file": "libfaad/bits.c", "function": "faad_resetbits" }, "deprecated": false }, { "digest": { "function_hash": "165736104238157740616725237501300890403", "length": 622.0 }, "id": "CVE-2019-15296-5875c100", "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174", "signature_type": "Function", "signature_version": "v1", "target": { "file": "libfaad/syntax.c", "function": "excluded_channels" }, "deprecated": false }, { "digest": { "threshold": 0.9, "line_hashes": [ "239380615314083555352035408016690435173", "147704977208189036895939348227306827051", "329365327040791695350858963688367662444", "216007562013221147565173244163313314080" ] }, "id": "CVE-2019-15296-d7b852b1", "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174", "signature_type": "Line", "signature_version": "v1", "target": { "file": "libfaad/syntax.c" }, "deprecated": false }, { "digest": { "threshold": 0.9, "line_hashes": [ "296485932489754999999010566109813086322", "251849693720230703288183735121492209136", "36364199145169944277639805905228073757", "82595847432278138315702463307550916764" ] }, "id": "CVE-2019-15296-fdd5e5d9", "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174", "signature_type": "Line", "signature_version": "v1", "target": { "file": "libfaad/bits.c" }, "deprecated": false } ] }