voc: fix division by zero when v->size is zero #264

Closed

openclaw-dev wants to merge 1 commit from openclaw-dev/sox_ng:fix/division-by-zero-voc into main

openclaw-dev commented

2026-08-23 03:05:52 +02:00

First-time contributor

Problem Background

Issue #247 reports a division by zero crash in the VOC audio format reader (src/voc.c). This was discovered by fuzzing torchaudio with sydr-fuzz.

The original report (SourceForge patch 127) noted that division by v->size occurs without necessary checking.

Root Cause

In read_samples_voc() (src/voc.c), line 344 performs: size_t per = max(1, 9 / v->size);

When v->size == 0 (which can occur when a malformed VOC file causes the format byte not to map to a valid size), this triggers undefined behavior / crash.

A pre-existing check at line 335 catches v->size == 0 but uses lsx_warn() followed by return 0 - returning success (0) instead of an error. This means sox_ng exits with status 0 even when the file is corrupt.

Fix

Replace lsx_warn() with lsx_fail_errno(ft, SOX_EFMT, ...):

-    lsx_warn("VOC input: zero file size");
+    lsx_fail_errno(ft, SOX_EFMT, "VOC input: zero file size");

This matches the pattern used by other error conditions in voc.c (e.g., lines 367, 604, 631, 640) and ensures the error is properly surfaced and sox_ng exits with a non-zero status code.

Key Changes

File: src/voc.c (1 line changed)
Line 336: Changed lsx_warn() to lsx_fail_errno(ft, SOX_EFMT, ...)
No new dependencies, no API changes, no behavioral changes for valid files

Verification

Syntax check: gcc -fsyntax-only passes
Logic test: Standalone test verifying v->size==0 triggers SOX_EFMT error (3/3 pass)
Only affects error path for malformed zero-size files; valid VOC files unaffected

## Problem Background Issue [#247](https://git.kaki87.net/sox_ng/sox_ng/issues/247) reports a division by zero crash in the VOC audio format reader (src/voc.c). This was discovered by fuzzing torchaudio with sydr-fuzz. The original report (SourceForge patch 127) noted that division by v->size occurs without necessary checking. ## Root Cause In read_samples_voc() (src/voc.c), line 344 performs: `size_t per = max(1, 9 / v->size);` When v->size == 0 (which can occur when a malformed VOC file causes the format byte not to map to a valid size), this triggers undefined behavior / crash. A pre-existing check at line 335 catches v->size == 0 but uses lsx_warn() followed by return 0 - returning success (0) instead of an error. This means sox_ng exits with status 0 even when the file is corrupt. ## Fix Replace lsx_warn() with lsx_fail_errno(ft, SOX_EFMT, ...): ```diff - lsx_warn("VOC input: zero file size"); + lsx_fail_errno(ft, SOX_EFMT, "VOC input: zero file size"); ``` This matches the pattern used by other error conditions in voc.c (e.g., lines 367, 604, 631, 640) and ensures the error is properly surfaced and sox_ng exits with a non-zero status code. ## Key Changes - File: src/voc.c (1 line changed) - Line 336: Changed lsx_warn() to lsx_fail_errno(ft, SOX_EFMT, ...) - No new dependencies, no API changes, no behavioral changes for valid files ## Verification - Syntax check: gcc -fsyntax-only passes - Logic test: Standalone test verifying v->size==0 triggers SOX_EFMT error (3/3 pass) - Only affects error path for malformed zero-size files; valid VOC files unaffected

openclaw-dev added 1 commit 2026-08-23 03:05:53 +02:00

voc: fix division by zero when v->size is zero 63e0469c41

Apply the SourceForge patch 127 fix: when v->size is 0 in
read_samples_voc(), use lsx_fail_errno() to report a proper error
instead of lsx_warn() + return 0 (which was interpreted as success).

This prevents a division by zero at line 344 (9 / v->size) when
malformed VOC files cause v->size to be zero, and ensures sox_ng
exits with a non-zero status code instead of 0 (success).

Closes: #247

Reported-by: sydr-fuzz fuzzing of torchaudio
Ref: SourceForge patch 127