rxi fe Out-of-Bounds Read Vulnerability in the read_ Function

A global buffer overflow vulnerability has been identified in rxi fe versions prior to ed4cda96bd582cbb08520964ba627efb40f3dd91. The issue arises in the read_ function within src/fe.c, where improper input handling leads to an out-of-bounds read. This vulnerability requires local access to exploit and has been publicly disclosed, with an available proof-of-concept exploit.

Impact

Exploitation of this vulnerability causes a global buffer overflow, allowing for out-of-bounds memory access which could potentially be exploited to execute arbitrary code or cause a crash.

Reproduction

The vulnerability can be reproduced by building rxi fe with release optimization and AddressSanitizer (ASan) enabled. After compiling the program, it can be run with a specific input file that triggers the out-of-bounds read. The AddressSanitizer will report the buffer overflow error, indicating that the vulnerability has been successfully exploited.