mp3gain is a program to analyze and adjust MP3 files to same volume.
The fuzz was done via the aacgain command-line tool which uses mp3gain which bundles an old-modified version of mpg123 called mpglibDBL.
The upstream project seems to be dead, so the issue wasn’t communicated to them.
The complete ASan output of the issue:
# aacgain -f $FILE ASAN:DEADLYSIGNAL ================================================================= ==23063==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x0000008aafe0 bp 0x7ffe06c66450 sp 0x7ffe06c663f0 T0) #0 0x8aafdf in sync_buffer /var/tmp/portage/media-sound/aacgain-1.9/work/aacgain-1.9/mp3gain/mpglibDBL/interface.c:393 #1 0x8ae64c in decodeMP3 /var/tmp/portage/media-sound/aacgain-1.9/work/aacgain-1.9/mp3gain/mpglibDBL/interface.c:665 #2 0x43e767 in main /var/tmp/portage/media-sound/aacgain-1.9/work/aacgain-1.9/mp3gain/mp3gain.c:2262 #3 0x7fa37f734680 in __libc_start_main (/lib64/libc.so.6+0x20680) #4 0x4426c8 in _start (/usr/bin/aacgain+0x4426c8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/media-sound/aacgain-1.9/work/aacgain-1.9/mp3gain/mpglibDBL/interface.c:393 in sync_buffer ==23063==ABORTING
This bug was discovered by Agostino Sarubbo of Gentoo.
2017-08-28: bug discovered
2017-09-08: blog post about the issue
2017-09-13: CVE Assigned