In the MP3 decoder of mp3_decoder.c, a raw 5-bit region-address field (value range 0-31) read directly from an MP3 frame's side-information bytes is used as an index into the 16-entry ra1tab lookup table without any bounds check, unlike the equivalent tsel < 16 guard already applied a few lines later for the big_htable/linbits_tbl lookups. A crafted MP3 frame with a region_address value of 16 or greater causes an out-of-bounds read past the end of the table, whose resulting garbage value also influences how many Huffman-coded coefficients are subsequently decoded. This is reachable simply by playing an attacker-supplied .mp3 file.
CWE-125, CWE-129
Artfical DT Developer Talha Berk Arslan