CVE-2019-1010315: Divide By Zero (CWE-369)
value: WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2019-07-11T20:15Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: cli/dsdiff.c
Commit date: 2019-03-02 18:37:14 -0800
Commit message: issue #65: make sure DSDIFF files have a valid channel count

Diff: diff --git a/cli/dsdiff.c b/cli/dsdiff.c
index 0ac43212..f357181c 100644
--- a/cli/dsdiff.c
+++ b/cli/dsdiff.c
@@ -178,11 +178,11 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
                     return WAVPACK_SOFT_ERROR;
             }
 
             if (!strncmp (prop_chunk, "SND ", 4)) {
                 char *cptr = prop_chunk + 4, *eptr = prop_chunk + dff_chunk_header.ckDataSize;
-                uint16_t numChannels, chansSpecified, chanMask = 0;
+                uint16_t numChannels = 0, chansSpecified, chanMask = 0;
                 uint32_t sampleRate;
 
                 while (eptr - cptr >= sizeof (dff_chunk_header)) {
                     memcpy (&dff_chunk_header, cptr, sizeof (dff_chunk_header));
                     cptr += sizeof (dff_chunk_header);
@@ -202,11 +202,11 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
                             WavpackBigEndianToNative (&numChannels, "S");
                             cptr += sizeof (numChannels);
 
                             chansSpecified = (int)(dff_chunk_header.ckDataSize - sizeof (numChannels)) / 4;
 
-                            if (numChannels < chansSpecified || numChannels < 1) {
+                            if (numChannels < chansSpecified || numChannels < 1 || numChannels > 256) {
                                 error_line ("%s is not a valid .DFF file!", infilename);
                                 free (prop_chunk);
                                 return WAVPACK_SOFT_ERROR;
                             }
 
@@ -277,10 +277,16 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
                     prop_chunk [0], prop_chunk [1], prop_chunk [2], prop_chunk [3], dff_chunk_header.ckDataSize);
 
             free (prop_chunk);
         }
         else if (!strncmp (dff_chunk_header.ckID, "DSD ", 4)) {
+
+            if (!config->num_channels) {
+                error_line ("%s is not a valid .DFF file!", infilename);
+                return WAVPACK_SOFT_ERROR;
+            }
+
             total_samples = dff_chunk_header.ckDataSize / config->num_channels;
             break;
         }
         else {          // just copy unknown chunks to output file
 

Vulnerable code:                 uint16_t numChannels, chansSpecified, chanMask = 0;
                            if (numChannels < chansSpecified || numChannels < 1) {
Fixed code:                 uint16_t numChannels = 0, chansSpecified, chanMask = 0;
                            if (numChannels < chansSpecified || numChannels < 1 || numChannels > 256) {

            if (!config->num_channels) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }