An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service. References: https://github.com/erikd/libsndfile/issues/429
Created libsndfile tracking bugs for this issue: Affects: fedora-all [bug 1659632]
Functions i2ulaw_array() in ulaw.c and i2alaw_array() in alaw.c use an attacker-controlled value to index a global array, however when the value is negative they get the opposite, which is undefined behaviour in case the original value is INT_MIN. Thus those functions could access some elements outside the limits of the ulaw_encode/alaw_encode buffers.
Upstream patch: https://github.com/erikd/libsndfile/commit/585cc28a93be27d6938f276af0011401b9f7c0ca
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1636 https://access.redhat.com/errata/RHSA-2020:1636
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-19662
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3922 https://access.redhat.com/errata/RHSA-2020:3922