Signed integer overflow in src/mat4.c:323

[shao-hua-li]

Hi there,

I found an undefined behavior in src/mat4.c:323, which is a signed integer overflow.

• libsndfile version: commit c7b69d7
• Compile args: CFLAGS='-fsanitize=undefined' ./configure --disable-shared && make
• Compiler: clang13
• Platform: Ubuntu 20.04.2 LTS, x86_64
• Reproduce: ./programs/sndfile-metadata-get mat4.c_int_overflow
• POC: mat4.c_int_overflow.tar.gz

Undefined Behavior Sanitizer report:

src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in

A possible quick fix is to add explicit type casting in mat4.c:323, like psf->dataend = psf->dataoffset + (long)rows * cols * psf->bytewidth ;

Another consequence of this bug is for clang -O1 and clang -O2, the frame filed in outputs would be different.

[arthurt]

mat4.c

	int		rows, cols, imag ;
...
		psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ;

So clang is complaining that the result of rows * cols overflows a 32-bit int. (Rows and cols are read from the file, and are stored as 32-bit there.)

psf->dataend is a sf_count_t, so 64-bits. A change of bracketing, or casting rows and cols each to (sf_count_t) before the multiplication would fix this.

[rfrohl]

FTR: someone assigned a CVE to this bug report: CVE-2022-33065

[stiepan]

Hi,
Are there any plans/timeline to address this issue and the CVE-2022-33065 vulnerability?