Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[raudio] Fixed buffer overflow when loading WAV files #4539

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

CalebHeydon
Copy link

This PR fixes a heap buffer overflow in raudio that can be triggered by a WAV file with a very large frame count. This is the result of two separate issues. The first is an integer overflow in the call to malloc since the unsigned integer can be overflowed when multiplied by the maximum number of channels (256). The second is using the 64-bit value for frame count even though it is cast to an unsigned int when allocating the buffer.

To fix this, I cast the frame count to a size_t in the malloc call, and I used 32-bit value for the number of frames to be written to the buffer. I recognize that issues like these aren't critical since the assets are almost always trusted, but it is nice to fix in case anyone wants to incorporate user-generated content into their game.

@orcmid
Copy link
Contributor

orcmid commented Nov 25, 2024

I'm not equipped to confirm the correctness of the patch. I do applaud the motivation and approach.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants