src/(rf64|w64|wav).c : Validate parsed channel count.

3 files changed, 18 insertions, 0 deletions

diff --git a/src/rf64.c b/src/rf64.c
index 2881aaf..203f87c 100644
--- a/src/rf64.c
+++ b/src/rf64.c
@@ -328,6 +328,12 @@ rf64_read_header (SF_PRIVATE *psf, int *blockalign, int *framesperblock)
 	if (psf->dataoffset <= 0)
 		return SFE_WAV_NO_DATA ;
 
+	if (psf->sf.channels < 1)
+		return SFE_CHANNEL_COUNT_ZERO ;
+
+	if (psf->sf.channels >= SF_MAX_CHANNELS)
+		return SFE_CHANNEL_COUNT ;
+
 	/* WAVs can be little or big endian */
 	psf->endian = psf->rwf_endian ;
 
diff --git a/src/w64.c b/src/w64.c
index 09afbfb..c05225d 100644
--- a/src/w64.c
+++ b/src/w64.c
@@ -375,6 +375,12 @@ w64_read_header	(SF_PRIVATE *psf, int *blockalign, int *framesperblock)
 	if (psf->dataoffset <= 0)
 		return SFE_W64_NO_DATA ;
 
+	if (psf->sf.channels < 1)
+		return SFE_CHANNEL_COUNT_ZERO ;
+
+	if (psf->sf.channels >= SF_MAX_CHANNELS)
+		return SFE_CHANNEL_COUNT ;
+
 	psf->endian = SF_ENDIAN_LITTLE ;		/* All W64 files are little endian. */
 
 	if (psf_ftell (psf) != psf->dataoffset)
diff --git a/src/wav.c b/src/wav.c
index d7e72ea..8458253 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -685,6 +685,12 @@ wav_read_header	(SF_PRIVATE *psf, int *blockalign, int *framesperblock)
 	if (psf->dataoffset <= 0)
 		return SFE_WAV_NO_DATA ;
 
+	if (psf->sf.channels < 1)
+		return SFE_CHANNEL_COUNT_ZERO ;
+
+	if (psf->sf.channels >= SF_MAX_CHANNELS)
+		return SFE_CHANNEL_COUNT ;
+
 	if (format != WAVE_FORMAT_PCM && (parsestage & HAVE_fact) == 0)
 		psf_log_printf (psf, "**** All non-PCM format files should have a 'fact' chunk.\n") ;