speexenc stack buffer overflow

[Aurorainfinity]

I have found a stack buffer overflow vulnerability in speexenc,this may cause a rce by open a crafted wav file
sample2.zip
the vulnerability function:
speexenc.c:122
} else {
nb_read = fread(in,1,to_read,fin);

[alexmurray]

Looks like this may also affect CELT as it has a very similarly named read_samples function that I suspect may be derived from this one in speex.

[kirotawa]

It was assigned as CVE-2020-23904

[tmatth]

I have found a stack buffer overflow vulnerability in speexenc,this may cause a rce by open a crafted wav file sample2.zip the vulnerability function: speexenc.c:122 } else { nb_read = fread(in,1,to_read,fin);

How exactly are you running the command-line? This sample gets rejected for me with:

cat sample2.wav | ./src/speexenc - out.spx
Only mono and (intensity) stereo supported

[00xc]

Any news on this issue? It was assigned a CVE number 2 months ago and it seems nobody has been able to reproduce it. Would it make sense to dispute it?

[tmatth]

I'm going to close this since as mentioned in #14 (comment) I cannot reproduce it.
It's worth noting that speexenc is a demo program and read_samples is not part of libspeex itself.