Audiofile NULL Pointer Dereference Vulnerability in ModuleState::setup Function

A NULL pointer dereference vulnerability has been identified in Audiofile version 0.3.7. The issue arises in the ModuleState::setup function, where a NULL pointer is accessed, leading to a runtime error. This vulnerability can be exploited to cause a denial-of-service condition by crashing the application.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing the application to crash. This behavior is indicative of a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by compiling Audiofile with AddressSanitizer enabled, using AFL (American Fuzzy Lop) as the compiler. After compiling and installing the application, the 'sfconvert' command can be used to process a crafted file that triggers the NULL pointer dereference. The AddressSanitizer will report the runtime error, indicating that a member was accessed through a NULL pointer, which caused a segmentation fault.

Remediation

Users are advised to update to the patched version available in the GitHub repository.