Skip to content

[stb_vorbis] Increase setup_malloc size parameter to uint64.#1960

Open
AliceLR wants to merge 1 commit into
nothings:masterfrom
AliceLR:fix-setup-malloc
Open

[stb_vorbis] Increase setup_malloc size parameter to uint64.#1960
AliceLR wants to merge 1 commit into
nothings:masterfrom
AliceLR:fix-setup-malloc

Conversation

@AliceLR

@AliceLR AliceLR commented Jun 3, 2026

Copy link
Copy Markdown

Marking as a draft for now since it's poorly tested, but this should fix #1933, #1947, and the second case in the comment #1168 (comment). However, it's not clear if this is the fix you actually want (particularly re: the definition of uint64 and various type-corrections).

@nothings I've noticed several dubious submissions duplicating parts of bug reports and patches I submitted years ago. Is there anything I can do to help?

Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc now reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.
@AliceLR AliceLR force-pushed the fix-setup-malloc branch from f5b1507 to 66fc4c6 Compare June 5, 2026 00:13
@AliceLR

AliceLR commented Jun 5, 2026

Copy link
Copy Markdown
Author
  • I've replaced the simple typedef for uint64 with a more robust version copied from libxmp's common.h. This fragment is probably non-copyrightable.
  • I removed the creeping type corrections and reduced this patch down to what should be the bare minimum to fix the affected setup_malloc, setup_temp_malloc, and setup_temp_free calls.

@AliceLR AliceLR marked this pull request as ready for review June 5, 2026 00:20
sezero pushed a commit to sezero/libxmp that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Mainstream P/R: nothings/stb#1960
Reference issue: libxmp#996
Also see: nothings/stb#1947
Also see: nothings/stb#1933
Also see: nothings/stb#1168 (comment)
sezero pushed a commit to sezero/libxmp that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Mainstream P/R: nothings/stb#1960
Reference issue: libxmp#996
Also see: nothings/stb#1947
Also see: nothings/stb#1933
Also see: nothings/stb#1168 (comment)
AliceLR added a commit to libxmp/libxmp that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Mainstream P/R: nothings/stb#1960
Reference issue: #996
Also see: nothings/stb#1947
Also see: nothings/stb#1933
Also see: nothings/stb#1168 (comment)

Co-authored-by: AliceLR <petrifiedrowan@gmail.com>
sezero pushed a commit to sezero/stb that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings#1947
Reference issue: nothings#1933
Also see       : nothings#1168 (comment)
Mainstream P/R : nothings#1960
sezero pushed a commit to icculus/SDL_sound that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960

(cherry picked from commit 19ae8a8)
sezero pushed a commit to icculus/SDL_sound that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960
sezero pushed a commit to libsdl-org/SDL_mixer that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960

(cherry picked from commit 369279b)
sezero pushed a commit to libsdl-org/SDL_mixer that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960
sezero pushed a commit to libsdl-org/SDL_mixer that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960

(cherry picked from commit 369279b)
sezero pushed a commit to libsdl-org/SDL_mixer that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960
sezero pushed a commit to libsdl-org/SDL_mixer that referenced this pull request Jun 5, 2026
Expands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960

(cherry picked from commit 52afb20)
Wohlstand added a commit to WohlSoft/SDL-Mixer-X that referenced this pull request Jun 5, 2026
Backported from libsdl-org/SDL_mixer@369279b

xpands the setup_malloc size parameter, and various calculations
that the Vorbis spec allows to exceed 32 bits, to uint64. setup_malloc
and setup_temp_malloc still reject allocations that exceed INT_MAX,
as the underlying memory fields are still 32 bit signed integers.

Reference issue: libxmp/libxmp#996
Reference issue: nothings/stb#1947
Reference issue: nothings/stb#1933
Also see       : nothings/stb#1168 (comment)
Mainstream P/R : nothings/stb#1960
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

stb_vorbis: integer overflow in codebook multiplicands allocation

1 participant