From c32c090ff9bb45e1dae637957c9c9b47b3967623 Mon Sep 17 00:00:00 2001 From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com> Date: Sat, 27 Jun 2026 14:34:16 +0200 Subject: [PATCH] sds: avoid divide-by-zero in sds_byterate for zero-frame files sds_read_header() sets psf->sf.frames directly from the file's 3-byte data-length field without a lower bound, so a crafted .sds file can leave psf->sf.frames == 0. SDS never sets psf->bytewidth, so sf_current_byterate() falls through to psf->byterate (sds_byterate), which computes (psf->datalength * psf->sf.samplerate) / psf->sf.frames dividing by zero -> SIGFPE crash (denial of service) when an application calls the public sf_current_byterate() on such a file. Guard the division with psf->sf.frames > 0, returning -1 (the same 'unknown' value already used for the write path) otherwise. Reproduced with a 21-byte crafted .sds (data-length field = 0) under AddressSanitizer: 'FPE ... in sds_byterate src/sds.c:761' before the fix; returns -1 cleanly after. CVE: CVE-2026-37555 Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623] Signed-off-by: Peter Marko --- src/sds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sds.c b/src/sds.c index 2a0f164c..1070e653 100644 --- a/src/sds.c +++ b/src/sds.c @@ -757,7 +757,7 @@ sds_seek (SF_PRIVATE *psf, int mode, sf_count_t seek_from_start) static int sds_byterate (SF_PRIVATE * psf) { - if (psf->file.mode == SFM_READ) + if (psf->file.mode == SFM_READ && psf->sf.frames > 0) return (psf->datalength * psf->sf.samplerate) / psf->sf.frames ; return -1 ;