FluidSynth Null Pointer Dereference Vulnerability in MIDI File Processing

A null pointer dereference vulnerability has been identified in FluidSynth versions through 2.4.6. The issue arises in the 'fluid_synth_monopoly.c' file when the application attempts to process an invalid MIDI file. This vulnerability can lead to a segmentation fault, causing the program to crash.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the FluidSynth application.

Reproduction

The vulnerability can be reproduced by loading an invalid MIDI file into FluidSynth 2.4.6. This can be done by using the FluidSynth command-line interface with the 'test.sf2' SoundFont and the 'mid_poc1.mid' MIDI file, both of which are available in the 'mid_poc.zip' archive.

Remediation

Users can upgrade to FluidSynth version 2.4.7, where this vulnerability has been fixed.