CVE-2020-36148

Vulnerability

The verifyAttribute function in tools.c line 26 of the libmysofa library (versions 0.5 through 1.1) does not properly validate that the attr->value pointer is non-NULL before dereferencing it [1]. When the library parses a maliciously crafted SOFA file, this pointer can be NULL, leading to undefined behavior. The code path is reachable when any application calls mysofa_open, mysofa_open_default, or mysofa_loudness on a specially crafted file [1].

Exploitation

An attacker must provide a crafted SOFA file that triggers the NULL pointer dereference [1]. No authentication or special network access is required if the user can be induced to open the file (e.g., via email or web download). The vulnerable function is called during parsing; a minimal reproducer is:

struct MYSOFA_EASY *easy = NULL;
easy = mysofa_open(filename, 48000, &filter_length, &err);

The crash occurs immediately in verifyAttribute when it calls a string comparison on the NULL attr->value [1].

Impact

On systems with restrictive memory protection (e.g., general-purpose operating systems), the NULL pointer dereference results in a segmentation fault and denial of service. On systems without memory protection (e.g., some embedded environments), the attacker may achieve near-NULL pointer overwrite, potentially leading to arbitrary memory write or code execution [1]. The CIA outcome varies: at minimum availability is lost; in constrained environments integrity and confidentiality may also be compromised.

Mitigation

The vulnerability was addressed in libmysofa version 1.2, released after the report [1][2]. Users should upgrade to version 1.2 or later. No workaround is available for unpatched versions; the only mitigation is to avoid opening untrusted SOFA files with libmysofa prior to 1.2.