rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Vulnerability ID: CVE-2017-6390
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/soruly/whatanime.ga
Published: 2017-03-02
File: index.php
Commit message: Fix #8 XSS issue
Commit author: soruly

Vulnerable version (before fix):
 <script src="/jquery.html5uploader.min.js"></script> <script src="/index.js"></script> <?php if(isset($_GET["url"])){ echo '<script> document.querySelector("#autoSearch").checked = true; document.querySelector("#messageText").classList.remove("error");

Fixed version (after fix):
 <script src="/jquery.html5uploader.min.js"></script> <script src="/index.js"></script> <?php if(isset($_GET["url"]) && filter_var($_GET["url"], FILTER_VALIDATE_URL)){ echo '<script> document.querySelector("#autoSearch").checked = true; document.querySelector("#messageText").classList.remove("error");

Patch:
patch: @@ -121,7 +121,7 @@
 <script src="/jquery.html5uploader.min.js"></script>
 <script src="/index.js"></script>
 <?php
-if(isset($_GET["url"])){
+if(isset($_GET["url"]) && filter_var($_GET["url"], FILTER_VALIDATE_URL)){
 echo '<script>
 document.querySelector("#autoSearch").checked = true;
 document.querySelector("#messageText").classList.remove("error");
path: index.php
Vulnerability: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
Vulnerability ID: CVE-2017-6415
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2017-03-02
File: libr/bin/p/bin_dex.c
Commit message: fix #6872
Commit author: h4ng3r

Vulnerable version (before fix):
 static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin, 		--parameters_size; 	}  	ut8 opcode = *(p4++) & 0xff; 	while (keep) { 		switch (opcode) {

Fixed version (after fix):
 static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin, 		--parameters_size; 	}  	if (p4 <= 0) { 		return; 	} 	ut8 opcode = *(p4++) & 0xff; 	while (keep) { 		switch (opcode) {

Patch:
patch: @@ -377,6 +377,9 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 		--parameters_size;
 	}
 
+	if (p4 <= 0) {
+		return;
+	}
 	ut8 opcode = *(p4++) & 0xff;
 	while (keep) {
 		switch (opcode) {
path: libr/bin/p/bin_dex.c
Vulnerability: libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.
Vulnerability ID: CVE-2017-6418
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/vrtadmin/clamav-devel
Published: 2017-08-07
File: libclamav/message.c
Commit message: bb11797 - fix invalid read in fuzzed mail file.
Commit author: Steven Morgan

Vulnerable version (before fix):
 messageAddArgument(message *m, const char *arg) 			 * FIXME: Bounce message handling is corrupting the in 			 * core copies of headers 			 */ 			cli_dbgmsg("Possible data corruption fixed\n"); 			p[8] = '='; 		} else { 			if(*p) 				cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p); messageFindArgument(const message *m, const char *variable) 				cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i)); 				return NULL; 			} 			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) { 				/* Remove any quote characters */ 				char *ret = cli_strdup(++ptr); 				char *p;

Fixed version (after fix):
 messageAddArgument(message *m, const char *arg) 			 * FIXME: Bounce message handling is corrupting the in 			 * core copies of headers 			 */                         if (strlen(p) > 8) {                             cli_dbgmsg("Possible data corruption fixed\n");                             p[8] = '=';                         } else {                             cli_dbgmsg("Possible data corruption not fixed\n");                         } 		} else { 			if(*p) 				cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p); messageFindArgument(const message *m, const char *variable) 				cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i)); 				return NULL; 			} 			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) { 				/* Remove any quote characters */ 				char *ret = cli_strdup(++ptr); 				char *p;

Patch:
patch: @@ -445,8 +445,12 @@ messageAddArgument(message *m, const char *arg)
 			 * FIXME: Bounce message handling is corrupting the in
 			 * core copies of headers
 			 */
-			cli_dbgmsg("Possible data corruption fixed\n");
-			p[8] = '=';
+                        if (strlen(p) > 8) {
+                            cli_dbgmsg("Possible data corruption fixed\n");
+                            p[8] = '=';
+                        } else {
+                            cli_dbgmsg("Possible data corruption not fixed\n");
+                        }
 		} else {
 			if(*p)
 				cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p);
@@ -682,7 +686,7 @@ messageFindArgument(const message *m, const char *variable)
 				cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i));
 				return NULL;
 			}
-			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
+			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
 				/* Remove any quote characters */
 				char *ret = cli_strdup(++ptr);
 				char *p;
path: libclamav/message.c
Vulnerability: The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
Vulnerability ID: CVE-2017-6420
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/vrtadmin/clamav-devel
Published: 2017-08-07
File: libclamav/wwunpack.c
Commit message: bb19798 - fix out of bound memory access for crafted wwunpack file.
Commit author: Steven Morgan

Vulnerable version (before fix):
 int wwunpack(uint8_t *exe, uint32_t exesz, uint8_t *wwsect, struct cli_exe_secti 	return CL_EFORMAT;     exe[pe+6]=(uint8_t)scount;     exe[pe+7]=(uint8_t)(scount>>8);     cli_writeint32(&exe[pe+0x28], cli_readint32(wwsect+0x295)+sects[scount].rva+0x299);     cli_writeint32(&exe[pe+0x50], cli_readint32(&exe[pe+0x50])-sects[scount].vsz); 

Fixed version (after fix):
 int wwunpack(uint8_t *exe, uint32_t exesz, uint8_t *wwsect, struct cli_exe_secti 	return CL_EFORMAT;     exe[pe+6]=(uint8_t)scount;     exe[pe+7]=(uint8_t)(scount>>8);     if (!CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295, 4) ||         !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva, 4) ||         !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva+0x299, 4)) {         cli_dbgmsg("WWPack: unpack memory address out of bounds.\n");         return CL_EFORMAT;     }     cli_writeint32(&exe[pe+0x28], cli_readint32(wwsect+0x295)+sects[scount].rva+0x299);     cli_writeint32(&exe[pe+0x50], cli_readint32(&exe[pe+0x50])-sects[scount].vsz); 

Patch:
patch: @@ -226,6 +226,12 @@ int wwunpack(uint8_t *exe, uint32_t exesz, uint8_t *wwsect, struct cli_exe_secti
 	return CL_EFORMAT;
     exe[pe+6]=(uint8_t)scount;
     exe[pe+7]=(uint8_t)(scount>>8);
+    if (!CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295, 4) ||
+        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva, 4) ||
+        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva+0x299, 4)) {
+        cli_dbgmsg("WWPack: unpack memory address out of bounds.\n");
+        return CL_EFORMAT;
+    }
     cli_writeint32(&exe[pe+0x28], cli_readint32(wwsect+0x295)+sects[scount].rva+0x299);
     cli_writeint32(&exe[pe+0x50], cli_readint32(&exe[pe+0x50])-sects[scount].vsz);
path: libclamav/wwunpack.c
Vulnerability: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
Vulnerability ID: CVE-2017-6435
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libimobiledevice/libplist
Published: 2017-03-15
File: src/bplist.c
Commit message: bplist: Make sure to bail out if malloc() fails in parse_string_node()

Credit to Wang Junjie <zhunkibatu@gmail.com> (#93)
Commit author: Nikias Bassen

Vulnerable version (before fix):
 static plist_t parse_string_node(const char **bnode, uint64_t size)      data->type = PLIST_STRING;     data->strval = (char *) malloc(sizeof(char) * (size + 1));     memcpy(data->strval, *bnode, size);     data->strval[size] = '\0';     data->length = strlen(data->strval);

Fixed version (after fix):
 static plist_t parse_string_node(const char **bnode, uint64_t size)      data->type = PLIST_STRING;     data->strval = (char *) malloc(sizeof(char) * (size + 1));     if (!data->strval) {         plist_free_data(data);         PLIST_BIN_ERR("%s: Could not allocate %" PRIu64 " bytes\n", __func__, sizeof(char) * (size + 1));         return NULL;     }     memcpy(data->strval, *bnode, size);     data->strval[size] = '\0';     data->length = strlen(data->strval);

Patch:
patch: @@ -289,6 +289,11 @@ static plist_t parse_string_node(const char **bnode, uint64_t size)
 
     data->type = PLIST_STRING;
     data->strval = (char *) malloc(sizeof(char) * (size + 1));
+    if (!data->strval) {
+        plist_free_data(data);
+        PLIST_BIN_ERR("%s: Could not allocate %" PRIu64 " bytes\n", __func__, sizeof(char) * (size + 1));
+        return NULL;
+    }
     memcpy(data->strval, *bnode, size);
     data->strval[size] = '\0';
     data->length = strlen(data->strval);
path: src/bplist.c
Vulnerability: An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).
Vulnerability ID: CVE-2017-6497
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-06
File: coders/psd.c
Commit message: Added missing null check.
Commit author: Dirk Lemstra

Vulnerable version (before fix):
 static MagickBooleanType ReadPSDChannel(Image *image,       }       mask=CloneImage(image,layer_info->mask.page.width,         layer_info->mask.page.height,MagickFalse,exception);       mask->matte=MagickFalse;       channel_image=mask;     }    offset=TellBlob(image);

Fixed version (after fix):
 static MagickBooleanType ReadPSDChannel(Image *image,       }       mask=CloneImage(image,layer_info->mask.page.width,         layer_info->mask.page.height,MagickFalse,exception);       if (mask != (Image *) NULL)         {           mask->matte=MagickFalse;           channel_image=mask;         }     }    offset=TellBlob(image);

Patch:
patch: @@ -1284,8 +1284,11 @@ static MagickBooleanType ReadPSDChannel(Image *image,
       }
       mask=CloneImage(image,layer_info->mask.page.width,
         layer_info->mask.page.height,MagickFalse,exception);
-      mask->matte=MagickFalse;
-      channel_image=mask;
+      if (mask != (Image *) NULL)
+        {
+          mask->matte=MagickFalse;
+          channel_image=mask;
+        }
     }
 
   offset=TellBlob(image);
path: coders/psd.c
Vulnerability: An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.
Vulnerability ID: CVE-2017-6500
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-06
File: coders/sun.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/375
https://github.com/ImageMagick/ImageMagick/issues/376
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)         ThrowReaderException(ResourceLimitError,"ImproperImageHeader");       }     pixels_length=height*bytes_per_line;     sun_pixels=(unsigned char *) AcquireQuantumMemory(pixels_length,       sizeof(*sun_pixels));     if (sun_pixels == (unsigned char *) NULL)       {

Fixed version (after fix):
 static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)         ThrowReaderException(ResourceLimitError,"ImproperImageHeader");       }     pixels_length=height*bytes_per_line;     sun_pixels=(unsigned char *) AcquireQuantumMemory(pixels_length+image->rows,       sizeof(*sun_pixels));     if (sun_pixels == (unsigned char *) NULL)       {

Patch:
patch: @@ -458,7 +458,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
         ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
       }
     pixels_length=height*bytes_per_line;
-    sun_pixels=(unsigned char *) AcquireQuantumMemory(pixels_length,
+    sun_pixels=(unsigned char *) AcquireQuantumMemory(pixels_length+image->rows,
       sizeof(*sun_pixels));
     if (sun_pixels == (unsigned char *) NULL)
       {
path: coders/sun.c
Vulnerability: An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.
Vulnerability ID: CVE-2017-6501
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-06
File: coders/xcf.c
Commit message: Check for image list before we destroy the last image in XCF coder (patch sent privately by Андрей Черный)
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)   }    (void) CloseBlob(image);   DestroyImage(RemoveFirstImageFromList(&image));   if (image_type == GIMP_GRAY)     image->type=GrayscaleType;   return(GetFirstImageInList(image));

Fixed version (after fix):
 static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)   }    (void) CloseBlob(image);   if (GetNextImageInList(image) != (Image *) NULL)     DestroyImage(RemoveFirstImageFromList(&image));   if (image_type == GIMP_GRAY)     image->type=GrayscaleType;   return(GetFirstImageInList(image));

Patch:
patch: @@ -1445,7 +1445,8 @@ static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)
   }
 
   (void) CloseBlob(image);
-  DestroyImage(RemoveFirstImageFromList(&image));
+  if (GetNextImageInList(image) != (Image *) NULL)
+    DestroyImage(RemoveFirstImageFromList(&image));
   if (image_type == GIMP_GRAY)
     image->type=GrayscaleType;
   return(GetFirstImageInList(image));
path: coders/xcf.c
Vulnerability: A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
Vulnerability ID: CVE-2017-6799
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2017-03-10
File: view_filters_page.php
Commit message: Fix XSS in view_filters_page.php

The value of the view_type parameter was not sanitized before being
displayed as a hidden input.

This vulnerability was reported by Etienne Landais.

Fixes #22497
Commit author: Damien Regad

Vulnerable version (before fix):
  	<?php # CSRF protection not required here - form does not result in modifications ?> 	<input type="hidden" name="type" value="1" /> 	<input type="hidden" name="view_type" value="<?php echo $f_view_type; ?>" /> 	<?php 		if( $f_for_screen == false ) { 			print '<input type="hidden" name="print" value="1" />';

Fixed version (after fix):
  	<?php # CSRF protection not required here - form does not result in modifications ?> 	<input type="hidden" name="type" value="1" /> 	<input type="hidden" name="view_type" value="<?php echo $t_filter['_view_type']; ?>" /> 	<?php 		if( $f_for_screen == false ) { 			print '<input type="hidden" name="print" value="1" />';

Patch:
patch: @@ -105,7 +105,7 @@
 
 	<?php # CSRF protection not required here - form does not result in modifications ?>
 	<input type="hidden" name="type" value="1" />
-	<input type="hidden" name="view_type" value="<?php echo $f_view_type; ?>" />
+	<input type="hidden" name="view_type" value="<?php echo $t_filter['_view_type']; ?>" />
 	<?php
 		if( $f_for_screen == false ) {
 			print '<input type="hidden" name="print" value="1" />';
path: view_filters_page.php
Vulnerability: An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
Vulnerability ID: CVE-2017-6800
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/Yeraze/ytnef
Published: 2017-03-10
File: lib/ytnef.c
Commit message: BugFix - data length

Even tho this is a "LONG" type, it's actually only 4 bytes. Typecasting
it to a long* caused a dereference beyond the end of the allocated
region.

issues#28
Commit author: Randall Hand

Vulnerable version (before fix):
 void MAPIPrint(MAPIProps *p) {           printf("] (%llu)\n", ddword_tmp);           break;         case PT_LONG:           printf("    Value: %li\n", *((long*)mapidata->data));           break;         case PT_I2:           printf("    Value: %hi\n", *((short int*)mapidata->data));

Fixed version (after fix):
 void MAPIPrint(MAPIProps *p) {           printf("] (%llu)\n", ddword_tmp);           break;         case PT_LONG:           printf("    Value: %i\n", *((int*)mapidata->data));           break;         case PT_I2:           printf("    Value: %hi\n", *((short int*)mapidata->data));

Patch:
patch: @@ -1390,7 +1390,7 @@ void MAPIPrint(MAPIProps *p) {
           printf("] (%llu)\n", ddword_tmp);
           break;
         case PT_LONG:
-          printf("    Value: %li\n", *((long*)mapidata->data));
+          printf("    Value: %i\n", *((int*)mapidata->data));
           break;
         case PT_I2:
           printf("    Value: %hi\n", *((short int*)mapidata->data));
path: lib/ytnef.c
Vulnerability: The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.
Vulnerability ID: CVE-2017-6829
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/antlarr/audiofile
Published: 2017-03-20
File: libaudiofile/modules/IMA.cpp
Commit message: clamp index values to fix index overflow in IMA.cpp

This fixes #33
(also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
Commit author: Antonio Larrosa

Vulnerable version (before fix):
 int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded) 		if (encoded[1] & 0x80) 			m_adpcmState[c].previousValue -= 0x10000;  		m_adpcmState[c].index = encoded[2];  		*decoded++ = m_adpcmState[c].previousValue;  int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded) 			predictor -= 0x10000;  		state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16); 		state.index = encoded[1] & 0x7f; 		encoded += 2;  		for (int n=0; n<m_framesPerPacket; n+=2)

Fixed version (after fix):
 int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded) 		if (encoded[1] & 0x80) 			m_adpcmState[c].previousValue -= 0x10000;  		m_adpcmState[c].index = clamp(encoded[2], 0, 88);  		*decoded++ = m_adpcmState[c].previousValue;  int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded) 			predictor -= 0x10000;  		state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16); 		state.index = clamp(encoded[1] & 0x7f, 0, 88); 		encoded += 2;  		for (int n=0; n<m_framesPerPacket; n+=2)

Patch:
patch: @@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
 		if (encoded[1] & 0x80)
 			m_adpcmState[c].previousValue -= 0x10000;
 
-		m_adpcmState[c].index = encoded[2];
+		m_adpcmState[c].index = clamp(encoded[2], 0, 88);
 
 		*decoded++ = m_adpcmState[c].previousValue;
 
@@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
 			predictor -= 0x10000;
 
 		state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
-		state.index = encoded[1] & 0x7f;
+		state.index = clamp(encoded[1] & 0x7f, 0, 88);
 		encoded += 2;
 
 		for (int n=0; n<m_framesPerPacket; n+=2)
path: libaudiofile/modules/IMA.cpp
Vulnerability: Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Vulnerability ID: CVE-2017-6831
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/antlarr/audiofile
Published: 2017-03-20
File: libaudiofile/WAVE.cpp
Commit message: Actually fail when error occurs in parseFormat

When there's an unsupported number of bits per sample or an invalid
number of samples per block, don't only print an error message using
the error handler, but actually stop parsing the file.

This fixes #35 (also reported at
https://bugzilla.opensuse.org/show_bug.cgi?id=1026983 and
https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp/
)
Commit author: Antonio Larrosa

Vulnerable version (before fix):
 status WAVEFile::parseFormat(const Tag &id, uint32_t size) 			{ 				_af_error(AF_BAD_NOT_IMPLEMENTED, 					"IMA ADPCM compression supports only 4 bits per sample"); 			}  			int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount; 			if (bytesPerBlock > blockAlign || (samplesPerBlock % 8) != 1) 			{ 				_af_error(AF_BAD_CODEC_CONFIG, 					"Invalid samples per block for IMA ADPCM compression"); 			}  			track->f.sampleWidth = 16;

Fixed version (after fix):
 status WAVEFile::parseFormat(const Tag &id, uint32_t size) 			{ 				_af_error(AF_BAD_NOT_IMPLEMENTED, 					"IMA ADPCM compression supports only 4 bits per sample"); 				return AF_FAIL; 			}  			int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount; 			if (bytesPerBlock > blockAlign || (samplesPerBlock % 8) != 1) 			{ 				_af_error(AF_BAD_CODEC_CONFIG, 					"Invalid samples per block for IMA ADPCM compression"); 				return AF_FAIL; 			}  			track->f.sampleWidth = 16;

Patch:
patch: @@ -326,13 +326,15 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
 			{
 				_af_error(AF_BAD_NOT_IMPLEMENTED,
 					"IMA ADPCM compression supports only 4 bits per sample");
+				return AF_FAIL;
 			}
 
 			int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
 			if (bytesPerBlock > blockAlign || (samplesPerBlock % 8) != 1)
 			{
 				_af_error(AF_BAD_CODEC_CONFIG,
 					"Invalid samples per block for IMA ADPCM compression");
+				return AF_FAIL;
 			}
 
 			track->f.sampleWidth = 16;
path: libaudiofile/WAVE.cpp