Unratedcrates.ioPublished
WaveFormat::parse reads past the end of a &WAVEFORMATEX
- Affected
- crates.io wasapi >= 0.20.0, < 0.25.0
- Fixed in
- 0.25.0· Vendor fix available
- Issue
- `WaveFormat::parse` is a safe function that takes a `&WAVEFORMATEX`, which is only valid for reads of `size_of:: ()` (18) bytes. When the header has `wFormatTag == WAVE_FORMAT_EXTENSIBLE` and `cbSize >= 22`, the function reinterprets the reference as a `WAVEFORMATEXTENSIBLE` and reads 40 bytes. Nothing in the signature guarantees that the header sits at the start of a larger buffer, so safe code can trigger an out-of-bounds read: ```rust use wasapi::WaveFormat; use windows::Win32::Media::Audio::WAVEFORMATEX; use windows::Win32::Media::KernelStreaming::WAVE_FORMAT_EXTENSIBLE; let header = WAVEFORMATEX { wFormatTag: WAVE_FORMAT_EXTENSIBLE as u16, nChannels: 2, nSamplesPerSec: 48000, nAvgBytesPerSec: 384000, nBlockAlign: 8, wBitsPerSample: 32, cbSize: 22, }; // Reads 22 bytes past the end of `header`. let _ = WaveFormat::parse(&header); ``` A more likely way to hit this is to copy the header out of a format pointer returned by WASAPI (`let fmt = unsafe { *ptr };`) and pass `&fmt`. The…
Recommended action: Upgrade to 0.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.