Remote No

Type Arbitrary code execution

Description

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument.

AVG-1387 wavpack 5.3.0-1 Medium Vulnerable FS#69234

https://github.com/dbry/WavPack/issues/91
https://github.com/dbry/WavPack/files/5745022/crash.wav.tar.gz
https://github.com/dbry/WavPack/commit/63f3ec70129843dd64e11aa4c21c4a1cf00c9f1c
https://github.com/dbry/WavPack/commit/89df160596132e3bd666322e1c20b2ebd4b92cd0