Vulnerability: Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.
Vulnerability ID: CVE-2017-6838
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/antlarr/audiofile
Published: 2017-03-20
File: sfcommands/sfconvert.c
Commit message: Check for multiplication overflow in sfconvert

Checks that a multiplication doesn't overflow when
calculating the buffer size, and if it overflows,
reduce the buffer size instead of failing.

This fixes the 00192-audiofile-signintoverflow-sfconvert case
in #41
Commit author: Antonio Larrosa

Vulnerable version (before fix):
 void printusage (void); void usageerror (void); bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);  int main (int argc, char **argv) { 	if (argc == 2) bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid) { 	int frameSize = afGetVirtualFrameSize(infile, trackid, 1);  	const int kBufferFrameCount = 65536; 	void *buffer = malloc(kBufferFrameCount * frameSize);  	AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK); 	AFframecount totalFramesWritten = 0;

Fixed version (after fix):
 void printusage (void); void usageerror (void); bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);  int firstBitSet(int x) {         int position=0;         while (x!=0)         {                 x>>=1;                 ++position;         }         return position; }  #ifndef __has_builtin #define __has_builtin(x) 0 #endif  int multiplyCheckOverflow(int a, int b, int *result) { #if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow)) 	return __builtin_mul_overflow(a, b, result); #else 	if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits 		return true; 	*result = a * b; 	return false; #endif }  int main (int argc, char **argv) { 	if (argc == 2) bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid) { 	int frameSize = afGetVirtualFrameSize(infile, trackid, 1);  	int kBufferFrameCount = 65536; 	int bufferSize; 	while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize)) 		kBufferFrameCount /= 2; 	void *buffer = malloc(bufferSize);  	AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK); 	AFframecount totalFramesWritten = 0;

Patch:
patch: @@ -45,6 +45,33 @@ void printusage (void);
 void usageerror (void);
 bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
 
+int firstBitSet(int x)
+{
+        int position=0;
+        while (x!=0)
+        {
+                x>>=1;
+                ++position;
+        }
+        return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+int multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+	return __builtin_mul_overflow(a, b, result);
+#else
+	if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+		return true;
+	*result = a * b;
+	return false;
+#endif
+}
+
 int main (int argc, char **argv)
 {
 	if (argc == 2)
@@ -323,8 +350,11 @@ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid)
 {
 	int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
 
-	const int kBufferFrameCount = 65536;
-	void *buffer = malloc(kBufferFrameCount * frameSize);
+	int kBufferFrameCount = 65536;
+	int bufferSize;
+	while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
+		kBufferFrameCount /= 2;
+	void *buffer = malloc(bufferSize);
 
 	AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
 	AFframecount totalFramesWritten = 0;
path: sfcommands/sfconvert.c