libmodplug has a resource consumption vulnerability (CWE-400) when parsing ABC (ABC Notation) music files. #105

Unbounded Memory Allocation in ABC File Parsing

In version 0.8.9.0, src/load_abc.cpp contains an unbounded resource consumption vulnerability in abc_add_gchord() at line 3180.

The stime calculation at line 3219 has no upper bound, and the while (rtime < stime) loop at line 3221 has no iteration limit.

During each iteration, abc_add_chordnote() / abc_add_noteoff() calls abc_new_event() (line 513), which allocates an ABCEVENT via _mm_calloc() (line 519). Consequently, memory usage can grow without bounds.

Call Chain

ModPlug_Load
  -> ReadABC
    -> abc_add_gchord
      -> abc_new_event
        -> calloc