An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sfcountt) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) blocks (int) exceeds INTMAX, the 32-bit multiplication overflows before being assigned to sf.frames (sfcountt/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircamreadheader function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution.

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sfcountt) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) blocks (int) exceeds INTMAX, the 32-bit multiplication overflows before being assigned to sf.frames (sfcountt/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

CVE-2022-33065[0]: | Multiple signed integers overflow in function aureadheader in | src/au.c and in functions mat4open and mat4readheader in | src/mat4.c in Libsndfile, allows an attacker to cause Denial of | Service or other unspecified impacts.

https://github.com/libsndfile/libsndfile/issues/833 https://github.com/libsndfile/libsndfile/issues/789

libsndfile through 1.2.2 has an oggvorbis.c vorbisanalysiswrote out-of-bounds read.

An integer overflow, leading to heap-based buffer overflow flaw was found in the way libsndfile, library for reading and writing of sound files, processed certain PARIS Audio Format (PAF) audio files with crafted count of channels in the PAF file header. A remote attacker could provided a specially-crafted PAF audio file, which once opened by a local, unsuspecting user in an application, linked against libsndfile could lead to that particular application crash (denial of service), or, potentially arbitrary code execution with the privileges of the user running the application.

References: [1] https://bugs.gentoo.org/showbug.cgi?id=375125 [2] http://www.securelist.com/en/advisories/45125 [3] http://secunia.com/advisories/45125/ [4] http://www.mega-nerd.com/libsndfile/

Relevant upstream patch (from Bzr log, local copy will be attached later too):

revno: 1610 committer: Erik de Castro Lopo <erikd> branch nick: libsndfile-dev timestamp: Wed 2011-07-06 19:40:05 +1000 message: Fix for Secunia Advisory SA45125, heap overflow in PAF file handler.

It was discovered that libsndfile incorrectly handled memory when executing its FLAC codec. If a user or automated system were tricked into processing a specially crafted sound file, an attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2021-4156) It was discovered that libsndfile incorrectly handled certain malformed OggVorbis files. An attacker could possibly use this issue to cause libsndfile to crash, resulting in a denial of service. (CVE-2024-50612)