Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.

An integer overflow, leading to heap-based buffer overflow flaw was found in the way libsndfile, library for reading and writing of sound files, processed certain PARIS Audio Format (PAF) audio files with crafted count of channels in the PAF file header. A remote attacker could provided a specially-crafted PAF audio file, which once opened by a local, unsuspecting user in an application, linked against libsndfile could lead to that particular application crash (denial of service), or, potentially arbitrary code execution with the privileges of the user running the application.

References: [1] https://bugs.gentoo.org/showbug.cgi?id=375125 [2] http://www.securelist.com/en/advisories/45125 [3] http://secunia.com/advisories/45125/ [4] http://www.mega-nerd.com/libsndfile/

Relevant upstream patch (from Bzr log, local copy will be attached later too):

revno: 1610 committer: Erik de Castro Lopo <erikd> branch nick: libsndfile-dev timestamp: Wed 2011-07-06 19:40:05 +1000 message: Fix for Secunia Advisory SA45125, heap overflow in PAF file handler.

The (1) htkreadheader, (2) alawinit, (3) ulawinit, (4) pcminit, (5) float32init, and (6) sdsreadheader functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.

Heap-based buffer overflow in aiffreadheader in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.

Heap-based buffer overflow in vocreadheader in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.

Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.

Buffer overflow in src/srcsinc.c in Secret Rabbit Code (aka SRC or libsamplerate) before 0.1.4, when "extreme low conversion ratios" are used, allows user-assisted attackers to have an unknown impact via a crafted audio file.

Heap-based buffer overflow in the flacbuffercopy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.