dr_libs CVE-2026-71261

dr_libs is a collection of single-header C audio decoding libraries authored by mackron; dr_wav.h handles both conventional WAV and W64 (Sony Wave 64) format files. W64 extends WAV by using 64-bit chunk size fields to support files larger than 4 GB. The vulnerability (CWE-190: Integer Overflow or Wraparound) lives in the W64 CUE chunk metadata parsing path across two functions. In drwav__metadata_process_chunk(), the library performs a stage-1 capacity pre-estimation by casting the 64-bit sizeInBytes field to size_t and dividing by DRWAV_CUE_POINT_BYTES; on 32-bit platforms where size_t is 4 bytes, the upper 32 bits of sizeInBytes are silently discarded before division, producing a capacity estimate that is far smaller than the actual chunk data warrants. In drwav__read_cue_to_metadata_obj(), the library then reads cuePointCount directly from the file - a fully attacker-controlled field - and derives the actual memory allocation from it without cross-checking against the stage-1 estimate. The function drwav__metadata_get_memory() enforces bounds only via DRWAV_ASSERT, which the C preprocessor strips entirely when -DNDEBUG is defined, as is standard in production release builds. The result is a classic heap buffer overflow driven by the divergence between a corrupted capacity estimate and an attacker-supplied object count. All versions are affected per CPE cpe:2.3:a:mackron:dr_libs:*:*:*:*:*:*:*:*.