A stack buffer overwrite was reported in TiMidity++ (external researcher report via PSIRTSUPT-30234; report and patch at https://gist.github.com/DicksonWu654/1cde815f70eaeb3c2c52b4801b80e09b). read_sysex_event() passes a stack array MidiEvent evm[260] to parse_sysex_event_multi() (timidity/readmidi.c:3261,3283 in 2.15.0). The XG bulk dump loops in that function (Effect 1 around line 798, Effect 2 around line 994, Multi Part around line 1038) add one event per SysEx body byte with no bound on the event count; the Effect 2 loop writes evm[num_events++] unconditionally for every body byte. A SysEx message with more than about 260 body bytes in a .mid file therefore writes past the end of evm. Opening or converting a crafted .mid file is sufficient to trigger it.

Verified in TiMidity++ 2.15.0 (last upstream release, 2018; upstream is unmaintained). Packaged builds abort with stack smashing detected (__stack_chk_fail); the reporter demonstrated a reliable crash (20/20) on Debian 2.14.0-8.5, Ubuntu 2.14.0-8.2ubuntu1 and Fedora 2.15.0-17.fc45, and no crash with the suggested bound-check patch. Only a crash is demonstrated, not code execution; the file controls part of the written bytes. Suggested severity: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5).

Red Hat exposure (newcli): timidity++ 2.15.0 ships in Fedora 43 (2.15.0-15.fc43), Fedora 44 (2.15.0-16.fc44) and Fedora rawhide (2.15.0-17.fc45) only. Not shipped in RHEL or EPEL. libtimidity (EPEL 8, Fedora) is based on timidity-0.2i and does not contain parse_sysex_event_multi - not affected.

Suggested fix: bound the XG bulk dump loops before evm fills (patch in the gist above). CVE ID to be assigned.