search

dbry / WavPack

WavPack encode/decode library, command-line programs, and several plugins
BSD 3-Clause "New" or "Revised" License
371 stars 67 forks source link

A heap overflow ???of wavpack in utils.c:618 #118

Closed youngcraft closed 2 years ago

youngcraft commented 2 years ago

When i use wavpack to transform my wav to some others wav-format file, the wavpack crashed.

the context of running sample below : ``

#3  0x00005555555b4cd6 in fread (__stream=0x555555675580, __n=0x95959596, __size=0x1, __ptr=<optimized out>)
    at /usr/include/x86_64-linux-gnu/bits/stdio2.h:297
#4  DoReadFile (hFile=hFile@entry=0x555555675580, lpBuffer=lpBuffer@entry=0x0, nNumberOfBytesToRead=nNumberOfBytesToRead@entry=0x95959596, 
    lpNumberOfBytesRead=lpNumberOfBytesRead@entry=0x7fffffffbb0c) at utils.c:618
#5  0x000055555559c086 in ParseRiffHeaderConfig (infile=0x555555675580, infilename=0x5555556752c0 "test09.wav", fourcc=<optimized out>, 
    wpc=0x555555675300, config=0x7fffffffbd60) at riff.c:296
#6  0x0000555555599386 in pack_file (infilename=0x5555556752c0 "test09.wav", outfilename=0x5555556752e0 "test09.wv", out2filename=0x0, 
    config=<optimized out>) at wavpack.c:1776

`` I store the crash wav in the my gitee storage: https://pan.baidu.com/s/1rJVMiOjQK2YseU6V8R6S6Q GetCode:apgz I run the wavpack this is : wavpack -y sample.wav

dbry commented 2 years ago

Hi, and thanks for letting me know about the crash. Unfortunately I was not able to use that link to obtain the file. I believe you should be able to upload the file here in the issue thread.

dbry commented 2 years ago

Are you able to provide this sample somehow? Your link does not work (at least in the USA).

BTW, did you test this with the current code in GitHub, or with the latest release?

youngcraft commented 2 years ago

Sorry，I test in the latest version , no bug existed . I used the wrong version of wavpack

dbry commented 2 years ago

Thanks for letting me know!