src/sphere.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

---

src/wav.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

src/wav.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 wav: ima_adpcm: fix buffer overflow on corrupt input
 Add the same check bad block size as was done for MS adpcm in patch
 0002-More-checks-for-invalid-MS-ADPCM-blocks.patch.

src/adpcm.c | 8 7 + 1 - 0 !
src/adpcm.h | 3 3 + 0 - 0 !
src/wav.c | 5 4 + 1 - 0 !
3 files changed, 14 insertions(+), 2 deletions(-)

 fix stack buffer overflow in lsx_ms_adpcm_block_expand_i

src/xa.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 xa: validate channel count
 A corrupt header specifying zero channels would send read_channels()
 into an infinite loop. Prevent this by sanity checking the channel
 count in open_read(). Also add an upper bound to prevent overflow
 in multiplication.

src/aiff.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 aiff: fix crash on empty comment chunk (cve-2017-15642)
 This fixes a use after free and double free if an empty comment
 chunk follows a non-empty one.

src/wav.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 wav: fix crash if channel count is zero
 WAV files declaring zero channels lead to division-by-zero crashes.
 numchannels = 0 is not a meaningful value, forbid it.

src/hcom.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 hcom: fix crash on input with corrupt dictionary

src/wav.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 wav: fix crash writing header when channel count >64k
 High number of channels (>64k) lead to divide-by-zero error and crash. Number
 of channels should be representable with 16 bits, so forbid any higher value.

src/flac.c | 8 5 + 3 - 0 !
1 file changed, 5 insertions(+), 3 deletions(-)

 flac: fix crash on corrupt metadata

src/xmalloc.c | 30 25 + 5 - 0 !
src/xmalloc.h | 7 4 + 3 - 0 !
2 files changed, 29 insertions(+), 8 deletions(-)

 [patch 1/5] clean up lsx_malloc() and friends

src/effects_i_dsp.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch 2/5] fix possible buffer size overflow in lsx_make_lpf()
 (CVE-2019-8354)

The multiplication in the size argument malloc() might overflow,
resulting in a small buffer being allocated.  Use calloc() instead.

src/xmalloc.c | 10 10 + 0 - 0 !
src/xmalloc.h | 5 3 + 2 - 0 !
2 files changed, 13 insertions(+), 2 deletions(-)

 [patch 3/5] fix possible overflow in lsx_(re)valloc() size
 calculation (CVE-2019-8355)

src/fft4g.c | 18 18 + 0 - 0 !
src/fft4g.h | 2 2 + 0 - 0 !
2 files changed, 20 insertions(+)

 [patch 4/5] fft4g: bail if size too large (cve-2019-8356)

Prevent overflowing of fixed-size buffers in bitrv2() and bitrv2conj()
if the transform size is too large.

src/effects_i_dsp.c | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 [patch 5/5] fix possible null pointer deref in lsx_make_lpf()
 (CVE-2019-8357)

If the buffer allocation fails, return NULL.