Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
Hello, Thank you for maintaining libsndfile in Fedora. I've attached a backport for CVE-2026-37555 for Fedora 43 and 44, and would appreciate your review. CVE-2026-37555 is an integer overflow in the IMA ADPCM codec. When libsndfile opens an IMA ADPCM WAV/W64 file, it computes the frame count as samplesperblock * blocks in 32-bit int arithmetic before storing it in the 64-bit sf_count_t. Both values come from the file, so a crafted header can wrap the result to a wrong, typically negative, frame count. The CVE describes this as leading to a heap overflow or denial of service. The same pattern is in the writer close path. It is the remaining part of the earlier CVE-2022-33065 fix, which only covered the AIFF reader. Fedora 43, 44, 45 and Rawhide all ship 1.2.2, which predates both upstream fixes, so all three calculations are still affected there. The patch casts samplesperblock to sf_count_t in all three places, so the product is computed in 64 bits: - ima_close() and the WAV/W64 reader, from upstream commit 3d63704f6654e8bc02fd5b97c069e7fd6a44e44c (the CVE-2026-37555 fix) - the AIFF reader, from upstream commit 9a829113c88a51e57c1e46473e90609e4b7df151 (CVE-2022-33065) After the patch, these lines match current upstream master. Testing: the patch applies cleanly to the current Fedora 43 and 44 sources, with the existing Fedora patches applied. I built the Fedora 44 source (with the system GSM library) and tested it with sparse WAV and AIFC files. Unpatched, both gave negative frame counts and were rejected. With the patch, both reported the expected positive counts and opened successfully. I have not done a Mock or full RPM build of the patched package. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Please let me know if you'd like any changes to the patch.
Created attachment 2161373 [details] backport of upstream patch