The Biosig Project Libbiosig Heap-Based Buffer Overflow Vulnerability in ISHNE ECG Annotations Parsing

A heap-based buffer overflow vulnerability has been identified in The Biosig Project's libbiosig version 3.9.0 and the Master Branch (35a819fa). This vulnerability arises in the ISHNE parsing functionality, where a specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. The issue is triggered when a malicious file is processed by the library.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by crafting an ISHNE ECG annotations file that manipulates the header information to control the file size and header length. When this file is processed by libbiosig, the parsing function will incorrectly calculate the number of events, leading to a heap-based buffer overflow. This can be verified using a debugger to observe the overwritten memory and executed payload.

Remediation

Users are advised to update to the patched version of libbiosig, which is available on the project's official website.