An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
| Link | Tags |
|---|---|
| https://sourceforge.net/p/sox/bugs/320 | third party advisory |
| https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html | mailing list |
| https://usn.ubuntu.com/4079-1/ | vendor advisory |
| https://usn.ubuntu.com/4079-2/ | vendor advisory |