Libsndfile Memory Leak Vulnerability in MP3 Encoder

A memory leak vulnerability has been identified in libsndfile versions 1.1.0 prior to 1.2.2. The issue arises in the MP3 encoding function 'mpeg_l3_encoder_init' within the 'mpeg_l3_encode.c' file. When the encoder initialization encounters an error, it fails to release allocated resources, leading to a memory leak.

Impact

Exploitation of this vulnerability causes a memory leak in the 'sndfile-convert' utility when processing MP3 files.

Reproduction

The vulnerability can be reproduced by encoding an MP3 file with a sample rate that is not supported by the MPEG-1/2/2.5 standards. This can be done using the 'sndfile-convert' command-line tool included with libsndfile. The AddressSanitizer will report the memory leak, indicating that allocated resources were not properly released due to the error handling in the encoder initialization.

Remediation

This vulnerability has been fixed in the official libsndfile repository.