Join GitHub today
type confusion(double's NAN & INF) vuls was found in function sfe_copy_data_fp() #317
Some type confusion vuls was found in function sfe_copy_data_fp() in programs/common.c of libsndfile-1.0.28:
} /* sfe_copy_data_fp */
There are two ways to generate NAN or INF double type by a craft audio file. first, the value of max may be 0 or inf, so it will subsequently get a NAN while "data[k]/=max"; second , the data may came from audio file directly, so data[k] may be NAN or INF and so does "data [k] /= max".
$ gdb programs/sndfile-convert
Program received signal SIGSEGV, Segmentation fault.