Bug#1116557: cuetools: Buffer overflow in time.c time_frame_to_mmssff

[Xi Rui]

Package: cuetools
Version: 1.4.1-0.2
Severity: grave
Justification: user security hole

Hello,

There is a buffer overflow issue in cuetools src/lib/time.c time_frame_to_mmssff
function. This function uses sprintf to format time into a buffer without
limiting boundary.

Reproduce with a cue file and cueconvert:

###
FILE "COCC-18150.wav" WAVE
  TRACK 01 AUDIO
    INDEX 01 11111111:00:00
###

I checked debian bug tracker and found this bug is firstly discovered in 
#576367.
But the patch for that is incorrect. It only increase buffer size by one, which
makes the issue still exists. I guess the correct fix should be replacing 
sprintf
with snprintf.

-- System Information:
Debian Release: 13.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.41-oct1u12-amd64 (SMP w/20 CPU threads; PREEMPT)
Kernel taint flags: TAINT_USER, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=zh_CN.UTF-8, LC_CTYPE=zh_CN.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages cuetools depends on:
ii  libc6            2.41-12
ii  python3-mutagen  1.47.0-1

Versions of packages cuetools recommends:
ii  flac          1.5.0+ds-2
ii  vorbis-tools  1.4.3-1

cuetools suggests no packages.

-- no debconf information

diff --git a/src/lib/time.c b/src/lib/time.c
index 91da91c..ff4402f 100644
--- a/src/lib/time.c
+++ b/src/lib/time.c
@@ -34,11 +34,11 @@ void time_frame_to_msf(long frame, int *m, int *s, int *f)
 /* print frame in mm:ss:ff format */
 char *time_frame_to_mmssff(long f)
 {
-       static char msf[10];
+       static char msf[9];
        int minutes, seconds, frames;
 
        msf_frame_to_msf(f, &minutes, &seconds, &frames);
-       sprintf(msf, "%02d:%02d:%02d", minutes, seconds, frames);
+       snprintf(msf, sizeof(msf), "%02d:%02d:%02d", minutes, seconds, frames);
 
        return msf;
 }