Heap out-of-bounds read in dr_flac SEEKTABLE metadata parsing
fixed
Details
dr_libs (dr_flac) mackron dr_flac ≤ 0.13.4 (through commit cd99e2c) CWE-125 medium fixed Timeline
9 Jul 2026 9 Jul 2026 14 Jul 2026 References
Notes
A crafted FLAC file opened with drflac_open_*_with_metadata() causes a
heap-based out-of-bounds read when the SEEKTABLE metadata block is parsed.
drflac__read_and_decode_metadata allocates the seekpoint buffer as
seekpointCount * sizeof(drflac_seekpoint) (24 bytes per point, padded) but
sets metadata.rawDataSize to the on-disk block size (DRFLAC_SEEKPOINT_SIZE_IN_BYTES
is 18). A consumer that reads pRawData for the documented rawDataSize bytes
therefore reads past the end of the allocation. SEEKTABLE is the only metadata
handler where the advertised size and the allocation disagree.
PoC: a 77-byte FLAC with a 35-byte SEEKTABLE block → 35 / 18 = 1 seekpoint
(24-byte buffer) but rawDataSize = 35, an 11-byte over-read, reproducible every
run under ASan. Fix is one line: set rawDataSize = seekpointCount * sizeof(drflac_seekpoint).