Re: mpg123: global buffer overflow in III_i_stereo (layer3.c)

[Agostino Sarubbo <ago () gentoo org>]

All the info were updated.


On Monday 10 July 2017 11:42:53 Dr. Thomas Orgis wrote:
> Is this really worth a CVE, though? So far I was only able to see a
> crash triggered by the AddressSanitizer.

Often, when there is an out-of-bound condition there is no crash, and the 
application works as expected. It is only visible with debuggers or in case of 
stack overflow with fortify_source enabled, so I think it's an expected 
behaviour.

-- 
Agostino Sarubbo
Gentoo Linux Developer