double64_init: Check psf->sf.channels against upper bound 70/162170/1 accepted/tizen/unified/20171130.113321 submit/tizen/20171130.043316
authorFabian Greffrath <fabian@greffrath.com>
Thu, 28 Sep 2017 10:15:04 +0000 (12:15 +0200)
committerSeungbae Shin <seungbae.shin@samsung.com>
Wed, 29 Nov 2017 10:18:52 +0000 (10:18 +0000)
commitcc712b615d4fb23334695cb081aa48cc59b7de60
treedcb213b532d886d9762bfb6d4c96d310149cdb05
parent7508a0995e3b61d6bc60627ffb951a1ae62bfa05
double64_init: Check psf->sf.channels against upper bound

This prevents division by zero later in the code.

While the trivial case to catch this (i.e. sf.channels < 1) has already
been covered, a crafted file may report a number of channels that is
so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets
miscalculated to zero (if this makes sense) in the determination of the
blockwidth. Since we only support a limited number of channels anyway,
make sure to check here as well.

CVE-2017-14634

Change-Id: Ifee1ff6c9af452f38725f4b599eae4ac069b93b5
Closes: https://github.com/erikd/libsndfile/issues/318
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
src/double64.c