[Security]FPE in alsa-utils axfer `wave_parser_pre_process

GitHub issues - opened <[email protected]> Sun, 5 Jul 2026 13:21:24 +0200 (CEST)
Newsgroups org.alsa-project.alsa-devel
Message-ID <[email protected]>
alsa-project/alsa-utils issue #332 was opened from eglonnnn:

### Description

A floating point exception vulnerability in alsa-utils v1.2.15.2. When `axfer`'s WAVE container parser processes a crafted WAVE file missing the `fmt` chunk, `samples_per_frame` and `frames_per_second` remain zero, causing a division-by-zero in `wave_parser_pre_process()`.

### Impact

- Denial-of-service via process crash
- Any user processing untrusted WAVE files with axfer is affected

### Reproduction

All materials are available in my research repository:
https://github.com/eglonnnn/opensource-fuzz-vulnerability-research/tree/main/FPE%20in%20alsa-utils%20axfer%20wave_parser_pre_process

Issue URL     : https://github.com/alsa-project/alsa-utils/issues/332
Repository URL: https://github.com/alsa-project/alsa-utils