An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service. References: https://github.com/erikd/libsndfile/issues/429
Created libsndfile tracking bugs for this issue: Affects: fedora-all [bug 1659628]
Upstream patch: https://github.com/erikd/libsndfile/commit/585cc28a93be27d6938f276af0011401b9f7c0ca
Functions i2ulaw_array() in ulaw.c and i2alaw_array() in alaw.c use an attacker-controlled value to index a global array, however when the value is negative they get the opposite, which is undefined behaviour in case the original value is INT_MIN. Thus those functions could access some elements outside the limits of the ulaw_encode/alaw_encode buffers.