File audiofile-CVE-2019-13147.patch of Package audiofile
diff --unified --recursive --text --new-file --color audiofile-0.3.6/libaudiofile/NeXT.cpp audiofile-0.3.6.new/libaudiofile/NeXT.cpp
--- audiofile-0.3.6/libaudiofile/NeXT.cpp 2013-03-06 13:30:03.000000000 +0800
+++ audiofile-0.3.6.new/libaudiofile/NeXT.cpp 2025-05-14 10:45:11.685700984 +0800
@@ -32,6 +32,7 @@
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "File.h"
#include "Setup.h"
@@ -122,6 +123,12 @@
_af_error(AF_BAD_CHANNELS, "invalid file with 0 channels");
return AF_FAIL;
}
+ /* avoid overflow of INT for double size rate */
+ if (channelCount > (INT32_MAX / (sizeof(double))))
+ {
+ _af_error(AF_BAD_CHANNELS, "invalid file with %i channels", channelCount);
+ return AF_FAIL;
+ }
Track *track = allocateTrack();
if (!track)