Control: tags -1 + fixed-upstream patch Hi,
Upstream issue #1151 was closed by this commit on master (2026-09-18). There has been no release since 1.2.2: https://www.google.com/url?q=https://github.com/libsndfile/libsndfile/commit/b2fc0c9deec0&source=gmail&ust=1793766688902000&sa=E "mat4: reject negative matrix dimensions in mat4_read_header." --- a/src/mat4.c +++ b/src/mat4.c @@ -276,6 +276,10 @@ mat4_read_header (SF_PRIVATE *psf) { psf_log_printf (psf, "*** Error : zero channel count.\n") ; return SFE_CHANNEL_COUNT_ZERO ; } + else if (rows < 0 || cols < 0) + { psf_log_printf (psf, "*** Error : bad matrix dimensions %d x %d.\n", rows, cols) ; + return SFE_CHANNEL_COUNT_BAD ; + } else if (rows > SF_MAX_CHANNELS) { psf_log_printf (psf, "*** Error : channel count %d > SF_MAX_CHANNELS.\n", rows) ; return SFE_CHANNEL_COUNT ; Root cause: negative rows/cols pass both the "rows == 0" and the "rows > SF_MAX_CHANNELS" checks. Two negative 32-bit values then multiply to a huge positive sf_count_t, and multiplying that by bytewidth overflows. Verified on the Debian 1.2.2-4 source with its debian/patches applied. The patch applies cleanly. I built with cmake and -fsanitize=address,undefined and opened the 157-byte PoC from the upstream issue (reconstructed from its hex dump) with sndfile-info: unpatched: src/mat4.c:318:78: runtime error: signed integer overflow: 4291899903585051664 * 8 cannot be represented in type 'long int' src/mat4.c:322:83: (same) src/mat4.c:323:41: runtime error: signed integer overflow: -2071690108 * -2071690108 cannot be represented in type 'int' src/mat4.c:107:35: runtime error: signed integer overflow: 8 * -2071690108 cannot be represented in type 'int' patched: "*** Error : bad matrix dimensions -2071690108 x -2071690108." No sanitizer reports. The full test suite (ctest) passes on the patched sanitizer build: 143/143, no ASan/UBSan reports. Since trixie is marked "postponed (revisit when fixed upstream)", this 4-line backport could also go there. Thanks!
