hitoshura25/cvefixes huggingface dataset:
CVE-2024-29859 (PHP, published 2024-03-21T04:15Z)
Description: value: In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/EventsController.php
Commit message: fix: [security] properly check for valid file upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)


Vulnerable code:
                    $data = FileAccessTool::readFromFile($file['tmp_name'], $file['size']);


Fixed code:
                    $matches = null;
                    $tmp_name = $file['tmp_name'];
                    if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($file['tmp_name'])) {
                        $data = FileAccessTool::readFromFile($matches[0][0], $file['size']);
                    } else {
                        throw new NotFoundException(__('Invalid file.'));    
                    }
CVE-2021-21418 (Unknown, published 2021-03-31T18:15Z)
Description: value: ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/ps_emailsubscription
Files changed:
Commit message: Merge pull request from GHSA-vwfx-hh3w-fj99

Escape newsletter condition field

Vulnerable code:

Fixed code:
CVE-2024-24043 (Other, published 2024-03-19T07:15Z)
Description: value: Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted file.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Speedy11CZ/mcrpx
Files changed:
common/src/main/java/cz/speedy11/mcrpx/common/util/ZipUtil.java
gradle.properties
Commit message: Hotfix for path traversal vulnerability


Vulnerable code:
projectDescription=Core library for plugins used by ketchup plugins, developed by Rajce.pro.
projectVersion=1.4.0

Fixed code:
                if (zipEntry.getName().contains("..")) {
                    listener.onMessage("Skipping " + zipEntry.getName() + ": Invalid path");
                    continue;
                }

                if (jarEntry.getName().contains("..")) {
                    listener.onMessage("Skipping " + jarEntry.getName() + ": Invalid path");
                    continue;
                }

projectDescription=MCRPX is a tool to extract files from Minecraft: Java Edition resource packs into selected directory. It can also bypass corrupted resource packs, used by servers to protect their resource packs.
projectVersion=1.4.1
CVE-2016-10169 (C, published 2017-03-14T14:59Z)
Description: value: The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
src/open_utils.c
src/read_words.c
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list


Vulnerable code:
    if (bytecnt) {

Fixed code:
    if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10170 (C, published 2017-03-14T14:59Z)
Description: value: The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
src/open_utils.c
src/read_words.c
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list


Vulnerable code:
    if (bytecnt) {

Fixed code:
    if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10171 (C, published 2017-03-14T14:59Z)
Description: value: The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
src/open_utils.c
src/read_words.c
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list


Vulnerable code:
    if (bytecnt) {

Fixed code:
    if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10172 (C, published 2017-03-14T14:59Z)
Description: value: The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
src/open_utils.c
src/read_words.c
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list


Vulnerable code:
    if (bytecnt) {

Fixed code:
    if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2018-10536 (C, published 2018-04-29T15:29Z)
Description: value: An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/riff.c
cli/wave64.c
Commit message: issue #30 issue #31 issue #32: no multiple format chunks in WAV or W64


Vulnerable code:
    int is_rf64 = !strncmp (fourcc, "RF64", 4), got_ds64 = 0;

Fixed code:
    int is_rf64 = !strncmp (fourcc, "RF64", 4), got_ds64 = 0, format_chunk = 0;
            if (format_chunk++) {
                error_line ("%s is not a valid .WAV file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

    int format_chunk = 0;
            if (format_chunk++) {
                error_line ("%s is not a valid .W64 file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }
CVE-2018-10537 (C, published 2018-04-29T15:29Z)
Description: value: An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/riff.c
cli/wave64.c
Commit message: issue #30 issue #31 issue #32: no multiple format chunks in WAV or W64


Vulnerable code:
    int is_rf64 = !strncmp (fourcc, "RF64", 4), got_ds64 = 0;

Fixed code:
    int is_rf64 = !strncmp (fourcc, "RF64", 4), got_ds64 = 0, format_chunk = 0;
            if (format_chunk++) {
                error_line ("%s is not a valid .WAV file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

    int format_chunk = 0;
            if (format_chunk++) {
                error_line ("%s is not a valid .W64 file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }
CVE-2018-10538 (C, published 2018-04-29T15:29Z)
Description: value: An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/dsdiff.c
cli/riff.c
cli/wave64.c
Commit message: issue #33, sanitize size of unknown chunks before malloc()


Vulnerable code:
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);

Fixed code:
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .WAV file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .W64 file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
CVE-2018-10539 (C, published 2018-04-29T15:29Z)
Description: value: An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/dsdiff.c
cli/riff.c
cli/wave64.c
Commit message: issue #33, sanitize size of unknown chunks before malloc()


Vulnerable code:
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);

Fixed code:
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .WAV file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .W64 file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
CVE-2018-10540 (C, published 2018-04-29T15:29Z)
Description: value: An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/dsdiff.c
cli/riff.c
cli/wave64.c
Commit message: issue #33, sanitize size of unknown chunks before malloc()


Vulnerable code:
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);
            char *buff = malloc (bytes_to_copy);

Fixed code:
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .WAV file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
            char *buff;

            if (bytes_to_copy < 0 || bytes_to_copy > 4194304) {
                error_line ("%s is not a valid .W64 file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
CVE-2018-19840 (C, published 2018-12-04T09:29Z)
Description: value: The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/dbry/WavPack
Files changed:
src/pack_utils.c
Commit message: issue #53: error out on zero sample rate


Vulnerable code:

Fixed code:
    if (!config->sample_rate) {
        strcpy (wpc->error_message, "sample rate cannot be zero!");
        return FALSE;
    }
CVE-2018-19841 (C, published 2018-12-04T09:29Z)
Description: value: The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
src/open_utils.c
Commit message: issue #54: fix potential out-of-bounds heap read


Vulnerable code:
                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))
                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))

Fixed code:
                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))
CVE-2018-6767 (C, published 2018-02-06T22:29Z)
Description: value: A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/riff.c
Commit message: issue #27, do not overwrite stack on corrupt RF64 file


Vulnerable code:
                !DoReadFile (infile, &ds64_chunk, chunk_header.ckSize, &bcount) ||
                bcount != chunk_header.ckSize) {
                !WavpackAddWrapper (wpc, &ds64_chunk, chunk_header.ckSize)) {
    int do_rf64 = 0, write_junk = 1;
        ds64hdr.ckSize = sizeof (ds64_chunk);
        (do_rf64 && (!DoWriteFile (outfile, &ds64_chunk, sizeof (ds64_chunk), &bcount) || bcount != sizeof (ds64_chunk))) ||
        (write_junk && (!DoWriteFile (outfile, &junkchunk, sizeof (junkchunk), &bcount) || bcount != sizeof (junkchunk))) ||

Fixed code:
#define CS64ChunkFormat "4D"
                !DoReadFile (infile, &ds64_chunk, sizeof (DS64Chunk), &bcount) ||
                bcount != sizeof (DS64Chunk)) {
                !WavpackAddWrapper (wpc, &ds64_chunk, sizeof (DS64Chunk))) {
    int do_rf64 = 0, write_junk = 1, table_length = 0;
    CS64Chunk cs64_chunk;
    total_riff_bytes += table_length * sizeof (CS64Chunk);
        ds64hdr.ckSize = sizeof (ds64_chunk) + (table_length * sizeof (CS64Chunk));
        ds64_chunk.tableLength = table_length;
    // this "table" is just a dummy placeholder for testing (normally not written)

    if (table_length) {
        strncpy (cs64_chunk.ckID, "dmmy", sizeof (cs64_chunk.ckID));
        cs64_chunk.chunkSize64 = 12345678;
        WavpackNativeToLittleEndian (&cs64_chunk, CS64ChunkFormat);
    }

        (do_rf64 && (!DoWriteFile (outfile, &ds64_chunk, sizeof (ds64_chunk), &bcount) || bcount != sizeof (ds64_chunk)))) {
            error_line ("can't write .WAV data, disk probably full!");
            return FALSE;
    }

    // again, this is normally not written except for testing

    while (table_length--)
        if (!DoWriteFile (outfile, &cs64_chunk, sizeof (cs64_chunk), &bcount) || bcount != sizeof (cs64_chunk)) {
            error_line ("can't write .WAV data, disk probably full!");
            return FALSE;
        }


    if ((write_junk && (!DoWriteFile (outfile, &junkchunk, sizeof (junkchunk), &bcount) || bcount != sizeof (junkchunk))) ||
CVE-2018-7253 (C, published 2018-02-19T23:29Z)
Description: value: The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/dsdiff.c
Commit message: issue #28, do not overwrite heap on corrupt DSDIFF file


Vulnerable code:
            char *prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);

Fixed code:
            char *prop_chunk;

            if (dff_chunk_header.ckDataSize < 4 || dff_chunk_header.ckDataSize > 1024) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            if (debug_logging_mode)
                error_line ("got PROP chunk of %d bytes total", (int) dff_chunk_header.ckDataSize);

            prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
CVE-2018-7254 (C, published 2018-02-19T23:29Z)
Description: value: The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/caff.c
Commit message: issue #28, fix buffer overflows and bad allocs on corrupt CAF files


Vulnerable code:
static const char TMH_full [] = { 1,2,3,13,9,10,5,6,12,14,15,16,17,9,4,18,7,8,19,20,21 };
static const char TMH_std [] = { 1,2,3,11,8,9,5,6,10,12,13,14,15,7,4,16 };
            CAFChannelLayout *caf_channel_layout = malloc ((size_t) caf_chunk_header.mChunkSize);
            if (caf_chunk_header.mChunkSize < sizeof (CAFChannelLayout) ||
                !DoReadFile (infile, caf_channel_layout, (uint32_t) caf_chunk_header.mChunkSize, &bcount) ||
            int bytes_to_copy = (uint32_t) caf_chunk_header.mChunkSize;
            char *buff = malloc (bytes_to_copy);

Fixed code:
static const char TMH_full [] = { 1,2,3,13,9,10,5,6,12,14,15,16,17,9,4,18,7,8,19,20,21,0 };
static const char TMH_std [] = { 1,2,3,11,8,9,5,6,10,12,13,14,15,7,4,16,0 };
            CAFChannelLayout *caf_channel_layout;
            if (caf_chunk_header.mChunkSize < sizeof (CAFChannelLayout) || caf_chunk_header.mChunkSize > 1024) {
                error_line ("this .CAF file has an invalid 'chan' chunk!");
                return WAVPACK_SOFT_ERROR;
            }

            if (debug_logging_mode)
                error_line ("'chan' chunk is %d bytes", (int) caf_chunk_header.mChunkSize);

            caf_channel_layout = malloc ((size_t) caf_chunk_header.mChunkSize);

            if (!DoReadFile (infile, caf_channel_layout, (uint32_t) caf_chunk_header.mChunkSize, &bcount) ||
            uint32_t bytes_to_copy = (uint32_t) caf_chunk_header.mChunkSize;
            char *buff;

            if (caf_chunk_header.mChunkSize < 0 || caf_chunk_header.mChunkSize > 1048576) {
                error_line ("%s is not a valid .CAF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            buff = malloc (bytes_to_copy);
CVE-2019-1010315 (C, published 2019-07-11T20:15Z)
Description: value: WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/dbry/WavPack
Files changed:
cli/dsdiff.c
Commit message: issue #65: make sure DSDIFF files have a valid channel count


Vulnerable code:
                uint16_t numChannels, chansSpecified, chanMask = 0;
                            if (numChannels < chansSpecified || numChannels < 1) {

Fixed code:
                uint16_t numChannels = 0, chansSpecified, chanMask = 0;
                            if (numChannels < chansSpecified || numChannels < 1 || numChannels > 256) {

            if (!config->num_channels) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }