double64_init: Check psf->sf.channels against upper bound 68/162168/1 accepted/tizen/4.0/unified/20171204.071001 submit/tizen_4.0/20171130.043308
authorFabian Greffrath <fabian@greffrath.com>
Thu, 28 Sep 2017 10:15:04 +0000 (12:15 +0200)
committerSeungbae Shin <seungbae.shin@samsung.com>
Wed, 29 Nov 2017 10:07:04 +0000 (19:07 +0900)
commit460b1065b58a82739ca45d54d8892c1725d76f59
treedcb213b532d886d9762bfb6d4c96d310149cdb05
parent7508a0995e3b61d6bc60627ffb951a1ae62bfa05
double64_init: Check psf->sf.channels against upper bound

This prevents division by zero later in the code.

While the trivial case to catch this (i.e. sf.channels < 1) has already
been covered, a crafted file may report a number of channels that is
so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets
miscalculated to zero (if this makes sense) in the determination of the
blockwidth. Since we only support a limited number of channels anyway,
make sure to check here as well.

CVE-2017-14634

Change-Id: Ifee1ff6c9af452f38725f4b599eae4ac069b93b5
Closes: https://github.com/erikd/libsndfile/issues/318
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
src/double64.c