Winamp 5.6 Arbitrary Code Execution in MIDI Parser
When Winamp plays MUS files and other MIDI variants, it begins by converting them to a canonical format. Timestamps in MIDI files are encoded by serializing 32 bit integers into 1, 2, 3, 4 or 5 bytes, storing 7 data bits in each byte. The last bit is used to indicate whether or not a given byte is the last. The serialization is done into an 8 byte buffer, which should be large enough, but there is a logic bug in the code which allows an attacker to write one byte outside of the buffer. The serialization is done by shifting the input value multiples of seven bits, until there is no more bits set. This is done using the x86 instruction SAR. Unfortunately this instruction does not clear the register when shifting more than the register width, but instead shifts the requested amount modulo the register width. By crafting an input file so that Winamp tries to serialize a value which has the most significant bit cleared and one of the following three bits set, an attacker can force the program to write the value shifted 0, 7, 14, 21, 28, 3, 10, 17 and 24 bits; a total of nine output bytes. The least significant value overflows into the saved base pointer.
