Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Sep 2017 09:26:15 +0200
From: "Dr. Thomas Orgis" <>
Subject: Re: mp3gain: NULL pointer dereference in sync_buffer

Hi Agostino,

thanks for pointing out that mp3gain is yet another user of an outdated
fork of mpg123 code. But this time with a twist: This again seems to be
a lifted version of the modified mpg123 code from Lame! A forked fork.

I'll have a look if I can rip that mpglib out of mp3gain and provide a
patch that uses an up-to-date libmpg123 for parsing instead. This would
perhaps be a better path forward for distros than to remove the
vulnerable mp3gain altogether.

An impressive list of vulnerabilities you have there … perhaps some
specific to mp3gain's modifications, but I guess the overflows in
layer3.c are well-known already from mpg123 and Lame.

Alrighty then,


Dr. Thomas Orgis
Universität Hamburg
RRZ / Basisinfrastruktur / HPC
Schlüterstr. 70
20146 Hamburg
Tel.: 040/42838 8826
Fax: 040/428 38 6270

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5898 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.