From 2f9f04989a1441bac672033525f35f9e903f1d40 Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Tue, 1 Jan 2019 20:11:46 +1100 Subject: [PATCH] src/wav.c: Fix heap read overflow This is CVE-2018-19758. Closes: https://github.com/erikd/libsndfile/issues/435 Gbp-Pq: Name src-wav.c-Fix-heap-read-overflow.patch --- src/wav.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/wav.c b/src/wav.c index 6020f20..286a57b 100644 --- a/src/wav.c +++ b/src/wav.c @@ -1,5 +1,5 @@ /* -** Copyright (C) 1999-2016 Erik de Castro Lopo +** Copyright (C) 1999-2019 Erik de Castro Lopo ** Copyright (C) 2004-2005 David Viens ** ** This program is free software; you can redistribute it and/or modify @@ -1098,6 +1098,8 @@ wav_write_header (SF_PRIVATE *psf, int calc_length) if (psf->instrument->loop_count > ARRAY_LEN (psf->instrument->loops)) psf->instrument->loop_count = ARRAY_LEN (psf->instrument->loops) ; + /* Loop count is signed 16 bit number so we limit it range to something sensible. */ + psf->instrument->loop_count &= 0x7fff ; for (tmp = 0 ; tmp < psf->instrument->loop_count ; tmp++) { int type ;