AdPlug vulnerabilities

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp. An attacker can read past a heap allocation by supplying a truncated TwinTeam DMO file (12 or 13 bytes) that passes dmo_unpacker::decrypt() and is opened via CAdPlug::factory.

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows reading before note_table by supplying a negative note index. An attacker can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback.

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. An attacker can supply a crafted .ksm module whose notes share one time slot, causing memory corruption and denial of service.