Threats affecting pkg:github/mmitch/gbsplay

gbsplay versions up to 0.0.103 contain a heap out-of-bounds read vulnerability in the vgm_open() function. This occurs because the function processes VGM command streams without proper bounds checking, allowing a crafted VGM file with specific wait opcodes and missing a 0x66 terminator to cause a read beyond the allocated heap buffer, potentially crashing the player.

Gbsplay versions up to 0.0.103 have a heap out-of-bounds read vulnerability in the gbr_open() function within gbs.c. This occurs because the function does not properly verify the length of the input GBR file before scanning the ROM title field. An attacker can craft a GBR file sized between 0x21 and 0x162 bytes to trigger reading beyond the allocated heap buffer, potentially causing a crash or memory leakage.

An out-of-bounds read vulnerability exists in gbsplay through version 0.0.103 in the mapper_map() function. This flaw allows crafted .gbr, .gbs, or .gb files with malicious ROM bank indexes to cause the player to read beyond the allocated heap buffer, potentially crashing the application.