dr_libs Integer Overflow Vulnerability in dr_flac Component Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in dr_flac, an audio decoder within the dr_libs toolset. The issue arises from an integer overflow caused by the decoder trusting the totalPCMFrameCount field from FLAC metadata without proper validation before calculating the buffer size. This flaw allows an attacker to craft a malicious FLAC file that, when processed by dr_flac, can lead to excessive memory allocation and cause programs using this tool to crash.

Impact

Exploitation of this vulnerability can cause programs that use dr_flac to crash, leading to a denial-of-service condition.

Remediation

The vulnerability has been patched in commit b2197b2. Users should update to the latest version.