CVE-2018-19840

The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.

References

Affected packages

Git / github.com/dbry/wavpack

Affected ranges

Type: GIT
Repo: https://github.com/dbry/wavpack
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

070ef6f138956d9ea9612e69586152339dbefe51

Affected versions

4.*

4.70.0

4.70.0-rc

4.75.0

4.75.0-rc

4.75.2

4.80.0

4.80.0-rc

5.*

5.0.0

5.0.0-alpha

5.0.0-alpha2

5.0.0-alpha3

5.0.0-alpha4

5.0.0-alpha5

5.1.0

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "source": "https://github.com/dbry/wavpack/commit/070ef6f138956d9ea9612e69586152339dbefe51",
        "digest": {
            "line_hashes": [
                "109524009393532704057515757123608873934",
                "308187253253712338333845699135135578363",
                "160307732922576192310224126902144133758"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/pack_utils.c"
        },
        "id": "CVE-2018-19840-01548206",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "source": "https://github.com/dbry/wavpack/commit/070ef6f138956d9ea9612e69586152339dbefe51",
        "digest": {
            "function_hash": "33576504915719694319716314055280451550",
            "length": 5678.0
        },
        "target": {
            "function": "WavpackSetConfiguration64",
            "file": "src/pack_utils.c"
        },
        "id": "CVE-2018-19840-edf4b29c",
        "signature_version": "v1",
        "signature_type": "Function"
    }
]