← Advisories

Heap out-of-bounds read in dr_flac SEEKTABLE metadata parsing

fixed

Details

Product dr_libs (dr_flac)
Vendor mackron
Affected dr_flac ≤ 0.13.4 (through commit cd99e2c)
CWE CWE-125
Severity medium
Status fixed

Timeline

Found 9 Jul 2026
Reported 9 Jul 2026
Fixed 14 Jul 2026

References

Notes

A crafted FLAC file opened with drflac_open_*_with_metadata() causes a heap-based out-of-bounds read when the SEEKTABLE metadata block is parsed.

drflac__read_and_decode_metadata allocates the seekpoint buffer as seekpointCount * sizeof(drflac_seekpoint) (24 bytes per point, padded) but sets metadata.rawDataSize to the on-disk block size (DRFLAC_SEEKPOINT_SIZE_IN_BYTES is 18). A consumer that reads pRawData for the documented rawDataSize bytes therefore reads past the end of the allocation. SEEKTABLE is the only metadata handler where the advertised size and the allocation disagree.

PoC: a 77-byte FLAC with a 35-byte SEEKTABLE block → 35 / 18 = 1 seekpoint (24-byte buffer) but rawDataSize = 35, an 11-byte over-read, reproducible every run under ASan. Fix is one line: set rawDataSize = seekpointCount * sizeof(drflac_seekpoint).