PT-2026-107652

WaveFormat::parse is a safe function that takes a &WAVEFORMATEX, which is only valid for reads of size of:: 18 bytes. When the header has wFormatTag == WAVE FORMAT EXTENSIBLE and cbSize = 22, the function reinterprets the reference as a WAVEFORMATEXTENSIBLE and reads 40 bytes. Nothing in the...