search

festvox / speech_tools

Edinburgh Speech Tools
Other
56 stars 25 forks source link

potential integer underflow #47

Open KihongHeo opened 3 years ago

KihongHeo commented 3 years ago

Hi,

I am wondering if there might exist an integer underflow error:

  1. comm_samples can be an any integer: https://github.com/festvox/speech_tools/blob/e2dcb2a37ed6bfe324ee586b739322a80cb51fc3/speech_class/EST_wave_io.cc#L796

  2. If length is zero, then data_length can be a negative integer: https://github.com/festvox/speech_tools/blob/e2dcb2a37ed6bfe324ee586b739322a80cb51fc3/speech_class/EST_wave_io.cc#L839

  3. So num_samples can be also a negative integer: https://github.com/festvox/speech_tools/blob/e2dcb2a37ed6bfe324ee586b739322a80cb51fc3/speech_class/EST_wave_io.cc#L857

  4. Call to fread with the negative integer: https://github.com/festvox/speech_tools/blob/e2dcb2a37ed6bfe324ee586b739322a80cb51fc3/speech_class/EST_wave_io.cc#L845

  5. memcpy with a negative number can be vulnerable: https://github.com/festvox/speech_tools/blob/e2dcb2a37ed6bfe324ee586b739322a80cb51fc3/base_class/EST_Token.cc#L407

Thanks for your time.