Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader

Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.

Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_

Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.

game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).

Stack-based buffer overflow in game-music-emu before 0.6.1.

The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

game-music-emu before 0.6.1 mishandles unspecified integer values.

game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.