Heap out-of-bounds read in dr_flac SEEKTABLE metadata parsing
fixed
Details
dr_libs (dr_flac) mackron dr_flac ≤ 0.13.4 (through commit cd99e2c) CWE-125 medium fixed Timeline
9 Jul 2026 9 Jul 2026 14 Jul 2026 References
Notes
A crafted FLAC file opened with drflac_open_*_with_metadata() causes a
heap-based out-of-bounds read when the SEEKTABLE metadata block is parsed.
drflac__read_and_decode_metadata allocates the seekpoint buffer as
seekpointCount * sizeof(drflac_seekpoint) (24 bytes per point, padded) but
sets metadata.rawDataSize to the on-disk block size (DRFLAC_SEEKPOINT_SIZE_IN_BYTES
is 18). A consumer that reads pRawData for the documented rawDataSize bytes
therefore reads past the end of the allocation. SEEKTABLE is the only metadata
handler where the advertised size and the allocation disagree.
PoC: a 77-byte FLAC with a 35-byte SEEKTABLE block → 35 / 18 = 1 seekpoint
(24-byte buffer) but rawDataSize = 35, an 11-byte over-read, reproducible every
run under ASan. Fix is one line: set rawDataSize = seekpointCount * sizeof(drflac_seekpoint).
The maintainer fixed the issue on 14 July 2026 in commit e1f125c1e03b and
closed issue #318. The original PoC was retested against current master
6d78776c2c05 on 20 July and exits cleanly under ASan/UBSan. dr_libs does not
publish GitHub releases, so downstreams need a sufficiently recent master
snapshot containing the fix.