CVE-2022-33065: Multiple signed integers overflow in function au_read_header in src/au.c and in functions...

The analysis focused on the commit 58428ae9c66029e1890f28b098041900707008c8, which was identified as closing the relevant GitHub issues and addressing the CVE. The diff of this commit shows changes in src/au.c and src/mat4.c.

In src/au.c, the function au_read_header was modified to change how it checks for potential overflow when calculating psf->dataoffset + au_header->data_size. The original check was insufficient and could lead to an overflow.

In src/mat4.c, the function mat4_read_header had several arithmetic operations involving data read from the file header (matrix rows, columns, byte width). These operations, such as rows * cols to determine frame count, and frames * bytewidth to determine data size, were vulnerable to integer overflows. The patch added explicit pre-condition checks to ensure these multiplications and subsequent additions would not overflow.

The function mat4_open is listed as vulnerable because it calls mat4_read_header, making it an entry point for the exploitation of the vulnerabilities within mat4_read_header.

The UBSAN logs from the GitHub issues directly pointed to lines within these functions where integer overflows were occurring, further corroborating that these functions are indeed the vulnerable ones. The patch directly addresses these reported overflow locations by adding or modifying checks around arithmetic operations involving externally controlled data.