mat4/mat5: fix int overflow when calculating blockwidth

Pre-cast the components of the blockwidth calculation to sf_count_t to avoid overflowing integers during calculation. CVE: CVE-2022-33065 Fixes: libsndfile#833 Signed-off-by: Alex Stewart <alex.stewart@ni.com>
arthenica · Oct 20, 2023 · 39f2a4f · 39f2a4f
1 parent 5d53193
commit 39f2a4f
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/mat4.c b/src/mat4.c
@@ -104,7 +104,7 @@ mat4_open	(SF_PRIVATE *psf)
 
 	psf->container_close = mat4_close ;
 
-	psf->blockwidth = psf->bytewidth * psf->sf.channels ;
+	psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
 
 	switch (subformat)
 	{	case SF_FORMAT_PCM_16 :

diff --git a/src/mat5.c b/src/mat5.c
@@ -114,7 +114,7 @@ mat5_open	(SF_PRIVATE *psf)
 
 	psf->container_close = mat5_close ;
 
-	psf->blockwidth = psf->bytewidth * psf->sf.channels ;
+	psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
 
 	switch (subformat)
 	{	case SF_FORMAT_PCM_U8 :