shithub: sox

Info  •  Files  •  Log  •  Branches

wav: fix crash if channel count is zero (CVE-2017-11332)

--- a/src/wav.c

+++ b/src/wav.c

@@ -712,6 +712,11 @@

     else

         lsx_report("User options overriding channels read in .wav header");

+    if (ft->signal.channels == 0) {

+        lsx_fail_errno(ft, SOX_EHDR, "Channel count is zero");

+        return SOX_EOF;

+    }

+

     if (ft->signal.rate == 0 || ft->signal.rate == dwSamplesPerSecond)

         ft->signal.rate = dwSamplesPerSecond;

     else