CVE-2020-14938: 
NixOS vulnerability analysis and mitigation

An issue was discovered in map.c in FreedroidRPG 1.0rc2 that affects the save game functionality. The vulnerability exists in the way the game handles data lengths read from saved game files, where it assumes fixed buffer sizes without proper validation (NVD). The issue was discovered in July 2019 and was assigned CVE-2020-14938.

The vulnerability exists in two functions within map.c: decode_map and decode_waypoints. Both functions allocate a fixed 4096-byte buffer but fail to validate the length of data being copied from save game files. The functions use memcpy to copy data between 'beginning_of_map' tag and newline character, or between 'wp' and newline character, without checking if the data exceeds the fixed buffer size (LogicalTrust).

When exploited, this vulnerability can lead to heap-based buffer overflow, which could result in memory corruption, application crashes, or potential arbitrary code execution. The issue affects users who load maliciously crafted save game files (LogicalTrust).

The vulnerability can be exploited by creating a malicious save game file that contains more than 4096 characters between specific tags. This could be achieved by modifying legitimate save files. The attack vector requires the victim to load a maliciously crafted save game file (LogicalTrust).

The vulnerability was fixed in commit 17711a4268 as noted in the bug tracker. Users should update to a version that includes this fix (FreedroidRPG Bug).