Skip to content

Reject unreasonable WAV header values - #879

Open
Mirochill wants to merge 1 commit into
jiaaro:masterfrom
Mirochill:fix-877-wav-header-bounds
Open

Reject unreasonable WAV header values#879
Mirochill wants to merge 1 commit into
jiaaro:masterfrom
Mirochill:fix-877-wav-header-bounds

Conversation

@Mirochill

Copy link
Copy Markdown

Summary

Reject WAV files with unreasonable header metadata before returning an AudioSegment.

Fixes #877.

Changes

  • Adds bounds checks for WAV channel count, sample rate, and bit depth in read_wav_audio().
  • Keeps existing 64-bit WAV support while rejecting extreme values such as 100MHz sample rates, 65k channels, or 65k-bit samples.
  • Adds regression coverage using synthetic WAV headers for each invalid metadata field.

Validation

Not run locally.

Static validation performed:

  • git diff --check

@Mirochill
Mirochill marked this pull request as ready for review May 25, 2026 18:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DoS via unbounded WAV header values in AudioSegment.from_wav()

1 participant