Vulnerability in diegonehab rply

[ Description ]Official description

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c
• github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c
• github.com/diegonehab/rply/issues/10
• hackmd.io/@haindpwn/rply-property-list-type-confusion
• www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-vi…