This issue is not public yet. Waiting for CRD.

---------------------------
Hello,

The following vulnerability report was received by Michele Spagnuolo of Google
Security Team.

The instrumented tool is "sox", run with arguments: filename.format x.wav.

We have 2 heap-oob (one sometimes also causes SIGSEGV), 1 null pointer
dereference and 6 divisions by zero that reproduce in both 14.3.1 and 14.4.1.
The memory corruptions on the heap are potentially exploitable.

The divisions by zero and the *(0x0), of course, are not security relevant, so
please ignore them in this Drive folder:

https://drive.google.com/folderview?id=0B52EFul-UCEIdWJYMzZFMk52WHc&usp=sharing

The maintainer provided 2 patches (they are attached) which have been
validated by original report.

As usual we would welcome CVEs, disclosure date is set one week from now:
December 22nd 15:00 CET.

Cheers
---------------------------

---
 src/sphere.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/sphere.c b/src/sphere.c
index 479a552..a3fd1c6 100644
--- a/src/sphere.c
+++ b/src/sphere.c
@@ -47,6 +47,11 @@ static int start_read(sox_format_t * ft)

   /* Determine header size, and allocate a buffer large enough to hold it. */
   sscanf(fldsval, "%lu", &header_size_ul);
+  if (header_size_ul < 16) {
+    lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header");
+    return (SOX_EOF);
+  }
+
   buf = lsx_malloc(header_size = header_size_ul);

   /* Skip what we have read so far */
-- 
2.1.0


CVE-2014-8145 was assigned to the heap corruptions as they are potentially exploitable.