Code: struct _mdi *_WM_ParseNewXmi(uint8_t *xmi_data, uint32_t xmi_size) {
    struct _mdi *xmi_mdi = NULL;
    uint32_t xmi_tmpdata = 0;
    uint8_t xmi_formcnt = 0;
    uint32_t xmi_catlen = 0;
    uint32_t xmi_subformlen = 0;
    uint32_t i = 0;
    uint32_t j = 0;

    uint32_t xmi_evntlen = 0;
    uint32_t xmi_divisions = 60;
    uint32_t xmi_tempo = 500000;
    uint32_t xmi_sample_count = 0;
    float xmi_sample_count_f = 0.0;
    float xmi_sample_remainder = 0.0;
    float xmi_samples_per_delta_f = 0.0;
    uint8_t xmi_ch = 0;
    uint8_t xmi_note = 0;
    uint32_t *xmi_notelen = NULL;

    uint32_t setup_ret = 0;
    uint32_t xmi_delta = 0;
    uint32_t xmi_lowestdelta = 0;

    uint32_t xmi_evnt_cnt = 0;


    if (memcmp(xmi_data,"FORM",4)) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
        return NULL;
    }

    xmi_data += 4;
    xmi_size -= 4;

    xmi_tmpdata = *xmi_data++ << 24;
    xmi_tmpdata |= *xmi_data++ << 16;
    xmi_tmpdata |= *xmi_data++ << 8;
    xmi_tmpdata |= *xmi_data++;
    xmi_size -= 4;

    if (memcmp(xmi_data,"XDIRINFO",8)) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
        return NULL;
    }
    xmi_data += 8;
    xmi_size -= 8;

    /*
     0x00 0x00 0x00 0x02 at this point are unknown
     so skip over them
     */
    xmi_data += 4;
    xmi_size -= 4;

    xmi_formcnt = *xmi_data++;
    if (xmi_formcnt == 0) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
        return NULL;
    }
    xmi_size--;

    /*
     at this stage unsure if remaining data in
     this section means anything
     */
    xmi_tmpdata -= 13;
    xmi_data += xmi_tmpdata;
    xmi_size -= xmi_tmpdata;

    /* FIXME: Check: may not even need to process CAT information */
    if (memcmp(xmi_data,"CAT ",4)) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
        return NULL;
    }
    xmi_data += 4;
    xmi_size -= 4;

    xmi_catlen = *xmi_data++ << 24;
    xmi_catlen |= *xmi_data++ << 16;
    xmi_catlen |= *xmi_data++ << 8;
    xmi_catlen |= *xmi_data++;
    xmi_size -= 4;

    UNUSED(xmi_catlen);

    if (memcmp(xmi_data,"XMID",4)) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
        return NULL;
    }
    xmi_data += 4;
    xmi_size -= 4;

    xmi_mdi = _WM_initMDI();
    _WM_midi_setup_divisions(xmi_mdi, xmi_divisions);
    _WM_midi_setup_tempo(xmi_mdi, xmi_tempo);

    xmi_samples_per_delta_f = _WM_GetSamplesPerTick(xmi_divisions, xmi_tempo);

    xmi_notelen = malloc(sizeof(uint32_t) * 16 * 128);
    memset(xmi_notelen, 0, (sizeof(uint32_t) * 16 * 128));

    for (i = 0; i < xmi_formcnt; i++) {
        if (memcmp(xmi_data,"FORM",4)) {
            _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
            goto _xmi_end;
        }
        xmi_data += 4;
        xmi_size -= 4;

        xmi_subformlen = *xmi_data++ << 24;
        xmi_subformlen |= *xmi_data++ << 16;
        xmi_subformlen |= *xmi_data++ << 8;
        xmi_subformlen |= *xmi_data++;
        xmi_size -= 4;

        if (memcmp(xmi_data,"XMID",4)) {
            _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
            goto _xmi_end;
        }
        xmi_data += 4;
        xmi_size -= 4;
        xmi_subformlen -= 4;

        do {
            if (!memcmp(xmi_data,"TIMB",4)) {
                xmi_data += 4;

                xmi_tmpdata = *xmi_data++ << 24;
                xmi_tmpdata |= *xmi_data++ << 16;
                xmi_tmpdata |= *xmi_data++ << 8;
                xmi_tmpdata |= *xmi_data++;
                xmi_data += xmi_tmpdata;
                xmi_size -= (8 + xmi_tmpdata);
                xmi_subformlen -= (8 + xmi_tmpdata);

            } else if (!memcmp(xmi_data,"RBRN",4)) {
                xmi_data += 4;

                xmi_tmpdata = *xmi_data++ << 24;
                xmi_tmpdata |= *xmi_data++ << 16;
                xmi_tmpdata |= *xmi_data++ << 8;
                xmi_tmpdata |= *xmi_data++;
                xmi_data += xmi_tmpdata;
                xmi_size -= (8 + xmi_tmpdata);
                xmi_subformlen -= (8 + xmi_tmpdata);

            } else if (!memcmp(xmi_data,"EVNT",4)) {
                xmi_data += 4;

                xmi_evnt_cnt++;

                xmi_evntlen = *xmi_data++ << 24;
                xmi_evntlen |= *xmi_data++ << 16;
                xmi_evntlen |= *xmi_data++ << 8;
                xmi_evntlen |= *xmi_data++;
                xmi_size -= 8;
                xmi_subformlen -= 8;

                do {
                    if (*xmi_data < 0x80) {
                        xmi_delta = 0;
                        if (*xmi_data > 0x7f) {
                            while (*xmi_data > 0x7f) {
                                xmi_delta = (xmi_delta << 7) | (*xmi_data++ & 0x7f);
                                xmi_size--;
                                xmi_evntlen--;
                                xmi_subformlen--;
                            }
                        }
                        xmi_delta = (xmi_delta << 7) | (*xmi_data++ & 0x7f);
                        xmi_size--;
                        xmi_evntlen--;
                        xmi_subformlen--;

                        do {
                            if ((xmi_lowestdelta != 0) && (xmi_lowestdelta <= xmi_delta)) {
                                xmi_tmpdata = xmi_lowestdelta;
                            } else {
                                xmi_tmpdata = xmi_delta;
                            }

                            xmi_sample_count_f= (((float) xmi_tmpdata * xmi_samples_per_delta_f) + xmi_sample_remainder);

                            xmi_sample_count = (uint32_t) xmi_sample_count_f;
                            xmi_sample_remainder = xmi_sample_count_f - (float) xmi_sample_count;

                            xmi_mdi->events[xmi_mdi->event_count - 1].samples_to_next += xmi_sample_count;
                            xmi_mdi->extra_info.approx_total_samples += xmi_sample_count;

                            xmi_lowestdelta = 0;

                            for (j = 0; j < (16*128); j++) {
                                if (xmi_notelen[j] == 0) continue;

                                xmi_notelen[j] -= xmi_tmpdata;

                                if (xmi_notelen[j] == 0) {
                                    xmi_ch = j / 128;
                                    xmi_note = j - (xmi_ch * 128);
                                    _WM_midi_setup_noteoff(xmi_mdi, xmi_ch, xmi_note, 0);
                                } else {
                                    if ((xmi_lowestdelta == 0) || (xmi_lowestdelta > xmi_notelen[j])) {
                                        xmi_lowestdelta = xmi_notelen[j];
                                    }
                                }
                            }
                            xmi_delta -= xmi_tmpdata;
                        } while (xmi_delta);

                    } else {
                        if ((xmi_data[0] == 0xff) && (xmi_data[1] == 0x51) && (xmi_data[2] == 0x03)) {
                             setup_ret = 6;
                             goto _XMI_Next_Event;
                         }
                        if ((setup_ret = _WM_SetupMidiEvent(xmi_mdi,xmi_data,0)) == 0) {
                             goto _xmi_end;
                         }
 
                        if ((*xmi_data & 0xf0) == 0x90) {
                            xmi_ch = *xmi_data & 0x0f;
                            xmi_note = xmi_data[1];
                            xmi_data += setup_ret;
                            xmi_size -= setup_ret;
                            xmi_evntlen -= setup_ret;
                            xmi_subformlen -= setup_ret;

                            xmi_tmpdata = 0;

                            if (*xmi_data > 0x7f) {
                                while (*xmi_data > 0x7f) {
                                    xmi_tmpdata = (xmi_tmpdata << 7) | (*xmi_data++ & 0x7f);
                                    xmi_size--;
                                    xmi_evntlen--;
                                    xmi_subformlen--;
                                }
                            }
                            xmi_tmpdata = (xmi_tmpdata << 7) | (*xmi_data++ & 0x7f);
                            xmi_size--;
                            xmi_evntlen--;
                            xmi_subformlen--;

                            xmi_notelen[128 * xmi_ch + xmi_note] = xmi_tmpdata;
                            if ((xmi_tmpdata > 0) && ((xmi_lowestdelta == 0) || (xmi_tmpdata < xmi_lowestdelta))) {
                                xmi_lowestdelta = xmi_tmpdata;
                            }

                        } else {
                        _XMI_Next_Event:
                            xmi_data += setup_ret;
                            xmi_size -= setup_ret;
                            xmi_evntlen -= setup_ret;
                            xmi_subformlen -= setup_ret;
                        }
                    }

                } while (xmi_evntlen);

            } else {
                _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0);
                goto _xmi_end;
            }

        } while (xmi_subformlen);
    }

    if ((xmi_mdi->reverb = _WM_init_reverb(_WM_SampleRate, _WM_reverb_room_width, _WM_reverb_room_length, _WM_reverb_listen_posx, _WM_reverb_listen_posy)) == NULL) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_MEM, "to init reverb", 0);
        goto _xmi_end;
    }
    xmi_mdi->extra_info.current_sample = 0;
    xmi_mdi->current_event = &xmi_mdi->events[0];
    xmi_mdi->samples_to_mix = 0;
    xmi_mdi->note = NULL;
    /* More than 1 event form in XMI means treat as type 2 */
    if (xmi_evnt_cnt > 1) {
        xmi_mdi->is_type2 = 1;
    }
    _WM_ResetToStart(xmi_mdi);

_xmi_end:
    if (xmi_notelen != NULL) free(xmi_notelen);
    if (xmi_mdi->reverb) return (xmi_mdi);
    _WM_freeMDI(xmi_mdi);
    return NULL;
}

Vulnerability Type: DoS 
CWE ID: CWE-125
Summary: The _WM_SetupMidiEvent function in internal_midi.c:2122 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
Commit Message: Add a new size parameter to _WM_SetupMidiEvent() so that it knows
where to stop reading, and adjust its users properly. Fixes bug #175
(CVE-2017-11661, CVE-2017-11662, CVE-2017-11663, CVE-2017-11664.)