shithub: sox

Info  •  Files  •  Log  •  Branches

fix possible buffer size overflow in lsx_make_lpf() (CVE-2019-8354)

The multiplication in the size argument malloc() might overflow,
resulting in a small buffer being allocated.  Use calloc() instead.

--- a/src/effects_i_dsp.c

+++ b/src/effects_i_dsp.c

@@ -357,7 +357,7 @@

     double scale, sox_bool dc_norm)

 {

   int i, m = num_taps - 1;

-  double * h = malloc(num_taps * sizeof(*h)), sum = 0;

+  double * h = calloc(num_taps, sizeof(*h)), sum = 0;

   double mult = scale / lsx_bessel_I_0(beta), mult1 = 1 / (.5 * m + rho);

   assert(Fc >= 0 && Fc <= 1);

   lsx_debug("make_lpf(n=%i Fc=%.7g β=%g ρ=%g dc-norm=%i scale=%g)", num_taps, Fc, beta, rho, dc_norm, scale);