{"action":"created","issue":{"url":"https://api.github.com/repos/dbry/WavPack/issues/7","labels_url":"https://api.github.com/repos/dbry/WavPack/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/dbry/WavPack/issues/7/comments","events_url":"https://api.github.com/repos/dbry/WavPack/issues/7/events","html_url":"https://github.com/dbry/WavPack/issues/7","id":110807841,"number":7,"title":"write beyond end of buffer in get_words_lossless","user":{"login":"mark4o","id":821151,"avatar_url":"https://avatars.githubusercontent.com/u/821151?v=3","gravatar_id":"","url":"https://api.github.com/users/mark4o","html_url":"https://github.com/mark4o","followers_url":"https://api.github.com/users/mark4o/followers","following_url":"https://api.github.com/users/mark4o/following{/other_user}","gists_url":"https://api.github.com/users/mark4o/gists{/gist_id}","starred_url":"https://api.github.com/users/mark4o/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mark4o/subscriptions","organizations_url":"https://api.github.com/users/mark4o/orgs","repos_url":"https://api.github.com/users/mark4o/repos","events_url":"https://api.github.com/users/mark4o/events{/privacy}","received_events_url":"https://api.github.com/users/mark4o/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-10T17:49:52Z","updated_at":"2015-11-29T00:20:24Z","closed_at":null,"body":"Calling `WavpackUnpackSamples()` can cause data to be written beyond the end of the output buffer and corrupt memory or crash with some input files.\r\n\r\nAn example wavpack file that demonstrates the issue (40 bytes, base64-encoded):\r\nd3ZwayAAAAAQBDAwMDAwMDAwMDAwMAEAMP8wMDAwMDANAQHoCgEwMA==\r\n\r\n`wavpack in.wv -o out.wav` crashes on OS X.  Running it under valgrind shows this:\r\n\r\n    Invalid write of size 4\r\n       at 0x10003E046: get_words_lossless (read_words.c:545)\r\n       by 0x10004ACE3: unpack_samples (unpack.c:160)\r\n       by 0x100051191: WavpackUnpackSamples (unpack_utils.c:243)\r\n       by 0x10000AA5E: repack_audio (wavpack.c:2872)\r\n       by 0x100004E01: repack_file (wavpack.c:2537)\r\n       by 0x100003751: main (wavpack.c:1118)\r\n     Address 0x1009f78f0 is 0 bytes after a block of size 262,144 alloc'd\r\n       at 0x10001AEBB: malloc (vg_replace_malloc.c:303)\r\n       by 0x10000AA41: repack_audio (wavpack.c:2869)\r\n       by 0x100004E01: repack_file (wavpack.c:2537)\r\n       by 0x100003751: main (wavpack.c:1118)\r\n    \r\n    Invalid write of size 4\r\n       at 0x10003D5E3: get_words_lossless (read_words.c:341)\r\n       by 0x10004ACE3: unpack_samples (unpack.c:160)\r\n       by 0x100051191: WavpackUnpackSamples (unpack_utils.c:243)\r\n       by 0x10000AA5E: repack_audio (wavpack.c:2872)\r\n       by 0x100004E01: repack_file (wavpack.c:2537)\r\n       by 0x100003751: main (wavpack.c:1118)\r\n     Address 0x1009f78f4 is 4 bytes after a block of size 262,144 alloc'd\r\n       at 0x10001AEBB: malloc (vg_replace_malloc.c:303)\r\n       by 0x10000AA41: repack_audio (wavpack.c:2869)\r\n       by 0x100004E01: repack_file (wavpack.c:2537)\r\n       by 0x100003751: main (wavpack.c:1118)\r\n\r\nBoth lines contain the statement:\r\n\r\n    buffer [csamples] = (getbit (bs)) ? ~low : low;\r\n\r\n`csamples` = 65536, but `buffer` contains only 65536 elements total."},"comment":{"url":"https://api.github.com/repos/dbry/WavPack/issues/comments/160348903","html_url":"https://github.com/dbry/WavPack/issues/7#issuecomment-160348903","issue_url":"https://api.github.com/repos/dbry/WavPack/issues/7","id":160348903,"user":{"login":"mark4o","id":821151,"avatar_url":"https://avatars.githubusercontent.com/u/821151?v=3","gravatar_id":"","url":"https://api.github.com/users/mark4o","html_url":"https://github.com/mark4o","followers_url":"https://api.github.com/users/mark4o/followers","following_url":"https://api.github.com/users/mark4o/following{/other_user}","gists_url":"https://api.github.com/users/mark4o/gists{/gist_id}","starred_url":"https://api.github.com/users/mark4o/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mark4o/subscriptions","organizations_url":"https://api.github.com/users/mark4o/orgs","repos_url":"https://api.github.com/users/mark4o/repos","events_url":"https://api.github.com/users/mark4o/events{/privacy}","received_events_url":"https://api.github.com/users/mark4o/received_events","type":"User","site_admin":false},"created_at":"2015-11-29T00:20:24Z","updated_at":"2015-11-29T00:20:24Z","body":"Thanks for looking into it.  Here is a file that triggers the second crash (1496 bytes, base64-encoded):\r\n\r\nd3Zwa+QCAAAQBDAwMDAwMAAAAAAwMAAA9jAwMDAwMDACAVdWMAIwMDAwijABADAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMHd2cGvkAgAAEAQwMDAwMDAwMAAAMDAAAAUYMDAwMDAwijABADAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA="}}