CVE-2021-4280: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch is 0cad44aa4a3eb0ecdba071c10eaff16023d8b35f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216780.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 6.5
Published: 2022-12-25T20:15Z
Repository: https://github.com/stylerw/styler_praat_scripts
Language: Other
Files changed: file_segmenter.praat, nasal_earbud_extract.praat
Commit date: 2021-11-24 09:37:08 -0800
Commit message: Improved File Segmenter

It should now be less vulnerable to certain characters in Textgrids (e.g. /) crashing everything.

Diff: diff --git a/file_segmenter.praat b/file_segmenter.praat
index 9cb4e32..c8c057c 100755
--- a/file_segmenter.praat
+++ b/file_segmenter.praat
@@ -25,11 +25,11 @@
 # This script is not by Will Styler, but is distributed by him because it's super useful.
 #######################################################################
 
 form Chopping long sound files
    comment Specify which tier in the TextGrid you want to segment by:
-        integer tier_number 2
+        integer tier_number 3
    comment Sound file extension:
         optionmenu file_type: 2
         option .aiff
         option .wav
    comment Filename base (soundfile name if left blank)
@@ -66,22 +66,27 @@ for j from 1 to number_of_files
 			            start = seg_start - 0.025
 			            end = seg_end + 0.025
 			            select Sound 'soundname$'
 			            Extract part: start, end, "rectangular", 1, "no"
 						if namebase$ <> ""
-			            	out_filename$ = "'out_dir$''namebase$'_'seg_label$'"
+			            	writename$ = "'namebase$'_'seg_label$'"
 						else
-			            	out_filename$ = "'out_dir$''soundname$'_'seg_label$'"
+			            	writename$ = "'soundname$'_'seg_label$'"
 						endif
+						# Although you should use ASCII when making textgrids, this bit removes some instacrashes
+						writename$ = replace$ (writename$, " ", "_", 0)
+						writename$ = replace$ (writename$, "/", "_", 0)
+						out_filename$ = "'out_dir$''writename$'"
 						# initialize anti-collision counter.
-			            aff = 1
+			        aff = 1
 						name$ = "'out_filename$'_'aff'"
-			            while fileReadable ("'name$'.wav")
-							#out_filename$ = "'out_dir$''soundname$'-'seg_label$'-'k'"
+
+						#writeInfo: name$
+			        while fileReadable ("'name$'.wav")
 							aff = aff + 1
 							name$ = "'out_filename$'_'aff'"
-			            endwhile
+			        endwhile
 			            Write to WAV file... 'name$'.wav
 			            select TextGrid 'soundname$'
 			            Extract part... 'start' 'end' no
 			            #Rename... 'out_filename$'
 			            Write to text file... 'name$'.TextGrid
diff --git a/nasal_earbud_extract.praat b/nasal_earbud_extract.praat
index 9d7ff8f..1665b24 100644
--- a/nasal_earbud_extract.praat
+++ b/nasal_earbud_extract.praat
@@ -243,11 +243,11 @@ for ifile to number_files
 			selectObject: "Sound 'soundname$'_nasalance"
 			percnas = Get value at time: 1, 'timepoint', "Nearest"
 			vwlpct = ((timepoint-intstart)/intdur)*100
 			
 			result_row$ = "'soundname$'" + tab$ + "'point'" + tab$ + "'vwlpct:2'" + tab$ + "'naspasc:10'" + tab$ + "'orpasc:10'" + tab$ + "'percnas:5'" + tab$ + "'timepoint:4'" + newline$
-			#fileappend "'resultfile$'" 'result_row$'
+			fileappend "'resultfile$'" 'result_row$'
 			
 		endfor
 	else
 		selectObject: "Sound 'soundname$'"
 		Remove

Vulnerable code:         integer tier_number 2
			            	out_filename$ = "'out_dir$''namebase$'_'seg_label$'"
			            	out_filename$ = "'out_dir$''soundname$'_'seg_label$'"
			            aff = 1
			            while fileReadable ("'name$'.wav")
							#out_filename$ = "'out_dir$''soundname$'-'seg_label$'-'k'"
			            endwhile
			#fileappend "'resultfile$'" 'result_row$'
Fixed code:         integer tier_number 3
			            	writename$ = "'namebase$'_'seg_label$'"
			            	writename$ = "'soundname$'_'seg_label$'"
						# Although you should use ASCII when making textgrids, this bit removes some instacrashes
						writename$ = replace$ (writename$, " ", "_", 0)
						writename$ = replace$ (writename$, "/", "_", 0)
						out_filename$ = "'out_dir$''writename$'"
			        aff = 1

						#writeInfo: name$
			        while fileReadable ("'name$'.wav")
			        endwhile
			fileappend "'resultfile$'" 'result_row$'