This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

BUGS

The more you look, the more you see.

Bugs in sox-14.4.2 are first bulk-listed here as one-liners and then migrate to the issues.

Already issued

• Fixes for all the CVEs reported against sox-14.4.2
• Patches from all the Distros that package SoX
• Patch tickets on sox.sf.net

To be issued

This OpenBSD post

Work in the forks

See Forks.

Open bugs on sox.sf.net created since 14.4.2

Legend
-       Not an issue
42b355  Only present in sox.sf.net, not 14.4.2 or sox_ng

BUG	Issue
377 silence -l does not work correctly	#258
375 'pipe' STDIN input broken	42b355
374 autoreconf overwrites INSTALL	-
373 .VOC text not processed	#563
372 threshold parameter for "silence" filter isn't handled correctly.	#395
371 Need a way to specify the directory for temporary files.	-
370 FPE in SoX 14.4.3git (src/​aiff.c:622:58 in lsx_aiffstartwrite)	-
369 FPE in SoX 14.4.3git（src/​voc.c:334:18 in read_samples)	42b355
368 heap-buffer-overflow in SoX 14.4.3git (hcom.c:160:41 in startread)	42b355
367 heap-buffer-overflow in SoX 14.4.3git (formats_i.c:98:16)	42b355
366 html and pdf generation is broken	-
365 sox: Soory, there is no default audio device configured	#396
364 sox spectrogram title option breaks when using keyword	#163
363 sox segfaults when parsing CLI options	42b355
362 CVE-2021-40426 sphere.c start_read() heap-based buffer overflow vulnerability	#27
361 sox not fading as expected	-
360 [BUG] two bugs in sox	14.4.2 42b355
359 DAT text file format broken on large number channel data files.	#412
358 Segmentation fault when creating a spectrogram with 3kHz limit	42b355
356 SoX handles 32bit float files with volume over 0 dBFS incorrectly	#422
355 File Length Error for specific combination of reverb and tremolo	#425
354 Device enumeration duplicates ->Coreaudio.c needs updating to modern APIs	#167 fixes property_size #183 for updating
352 heap-overflow in formats_i.c	CVE-2021-23159 14.4.2 42b355
351 div zero in voc.c	CVE-2021-3643 42b355 #247
350 Heap overflow in hcom.c	CVE-2021-23172 42b355
349 div zero crash in wav.c	CVE-2021-33844 42b355
346 sox noisered dies with segv	CVE-2021-33844 42b355 #26
345 Sox should preserve all aiff headers	#441 #446
343 speed effect not effective using soxlib APIs	#442
329 Outputting ogg/​vorbis via the output effect is extremely slow	#545
323 devided by zero issue in flanger.c	#536
322 sox FAIL noisered: multi-channel effect drained asymmetrically! error	#548
314 Incorrect work of sox_read function with In-memory output buffers	#241
313 libsox.dylib generated incorrectly on OS X 10.10 and later (pending-fixed)	-
309 Preventing division by zero in src/ao.c	#537
307 Filename with Special Characters fail	#203
304 Incorrect ByteRate and Non-Integer SampleRates	#552
295 clipping warning even with guard	#256
293 stats effect returns -inf if window is set to 0.36 seconds	#561
276 'gain -n' causes SoX v14.4.2 to not delete tmp file	#468
274 Codec bug in IMA and OKI ADPCM algorithms.	#562
263 FAIL sox: Sorry, there is no default audio device configured	#396
262 Double free when applying a LADSPA plugin with 2 input channels and 3 output channels	#245

Closed bugs on sox.sf.net created since 14.4.2

BUG	Status	Issue/commit
376 mailing lists not working	closed	-
353 Recording 24/32 bits audio not in proper wave format	closed	cb1945e
348 syntax error near unexpected token `-fstack-protector-strong'	closed-invalid	-
347 error metadata.cpp, Line 636 Expression: is_valid()	closed-invalid	-
344 invalid option "-w" error	closed	#210
342 sox has exited with error code 2 with Google Speech API	closed	-
341 help text hides option parsing error message	closed-invalid	8527195
340 Documentation mismatch for -A /​ -U	closed-out-of-date	-
339 trim nr samples different behavior from nr seconds	closed-invalid	-
338 Spectrogram of very BIG file	closed-invalid	#530
337 Output wav file >4gb corrupted from Sox remix of 3 wav files nto one wav file	closed-invalid	#530
334 Segmentation fault in rate.c:504:30	closed-fixed	#56
333 Assertion fail in rate.c:303	closed-fixed	#532
332 configure fails: syntax error near unexpected token `-Wl,--as-needed'	closed	#278
331 A Floating point exception in wav.c:950:80	closed-invalid	#7
330 Playing file through SoX	closed-invalid	-
328 Error code 2 with Google Speech API on EC2 instance	closed-invalid	-
327 Memcpy-param-overlap in mp3-util.h	closed-fixed	#533
326 sox_sample_test.h needs math.h for fabs()	closed-fixed	837d101
325 Integer Overflow in sox-fmt.c	closed-fixed	#20
324 Fix broken URLs in man page	closed-fixed	Done
321 Stack-Buffer-Overflow in fft4g.c	closed-fixed	#18
320 Integer Overflow in xmalloc.h	closed-fixed	#17
319 Integer Overflow resulting in Heap-Buffer-Overflow in effect_i_dsp.c	closed-fixed	#15
318 NULL pointer dereference in effect_i_dsp.c	closed-fixed	#19
317 sox cannot handle true 32 bit	closed-fixed
316 sox command	closed-invalid	-
315 Converting the same wav file twice throws different output	closed-invalid	-
312 Null byte at the end of gsrt files causes a click in playback	closed-fixed	#538
311 Unexpected display behavior when less than 80 columns	closed-fixed	#540
310 Parsing 0-frame aiff file fails with error: Missing SSND chunk in AIFF file	closed-fixed	#541
308 [PATCH] assertion failed (core dumped) while converting wav to hcom on 64 bit big endian machine	closed-fixed	#42
306 Version info not displayed	closed-fixed	#159
305 Sox blocking in an infinite loop when decoding AMR files	closed-fixed	#542
303 Sox/​play WAV playing in double speed	closed-duplicate	#543
302 Missing $(DESTDIR) before ${bindir} in src/​Makefile.am installcheck	closed-fixed	e4dcfe3
301 Bad FSF address in src/​ladspa.h	closed-fixed	126779c
300 sox v14.4.2 segmentation violation when playing some wav files generated by Audacity	closed-fixed	03eb5e9 38ea5cf
299 Invalid memory read via crafted .xa file	closed-fixed	#14
298 Use-after-free while feeding malformed aiff file	closed-fixed
297 SoX v14.4.2 vulnerable to a heap use-after-free condition after parsing AIFF file and calling sox_append_comments()	closed-fixed
296 CVE-2017-11332, CVE-2017-11332, CVE-2017-11359	closed-fixed
294 Wrong conversion from 8 bit to 16 bit	closed-rejected	#564
292 Precision of 32-bit float appears incorrect	closed-invalid	-
291 Support ID3 tags version 2.4	closed-invalid	-
290 sox_open_mem_write() on windows not worked	closed-wont-fix
286 Skipped AIFF chunks fail to account for pad byte.	closed-fixed
285 pipe decoded audio from ffmpeg to sox	closed-wont-fix
284 Please update LibFlac.vcxproj to work with flac 1.3	closed
283 Z_SOLO macro in LibZLib.vcxproj	closed
282 Compiler error C2039 in VS 2015	closed-fixed
281 repeat not working in a chain of effects	closed-invalid	-
278 Infinite loop, info command and verbose output for corrupt WAV file	closed-fixed
277 pulseaudio sound handler is buggy/​inconsistent	closed-fixed
275 Different output length from trim if source is AIFF file	closed
273 stdin/​stdout not released when lsx_close called	closed-fixed
272 sox_formats_quit does not properly clean things up	closed-fixed
271 Can't open files which contains foreign characters	closed-duplicate
270 Current git fails to build debian package on Debian and Ubuntu	closed-fixed
269 sox play fails following Ubuntu 14.04 upgrade (3.13.0-65-generic)	closed-invalid	-
268 Permission denied	closed-invalid	-
267 "Bit-depth" stats result changes when signal is inverted	closed-fixed
266 sox-14.4.2/src/mp3.c:407: undefined reference to `lsx_error'	closed-fixed
265 Multiple memory corruption vulnerabilities in SoX 14.4.2	closed-fixed
264 sox is losing frames when trimming	closed-out-of-date
261 absurd docs bug - PDF is doubled 14.4.1 and 14.4.2	closed-fixed
260 Reading from memory files depends upon uninitialized value read	closed-fixed
259 sox WARN formats: can't set sample rate X; using Y	closed-invalid	-
258 Sox produces non-deterministic /​ non-reproducible output when resampling!	closed-invalid	-
257 ./sox monkey.wav -r 12500 -2 -s monkey.xxx FAILS in currents snapshot	closed-fixed
214 sox does not respond to SIGINT over ssh	closed-fixed	#540

Merge requests on sox.sf.net

#	Description	Issue
1	Fix bit-depth calculation	#273
2	make it read Alaw Sphere file
3	Release holds on stdin/stdout when we have finished with them
4	Rudimentary support for NSP format	#272
5	Add 192kHz support to RIAA EQ deemphasis biquad effect	#173
6	Fix memory buffer rewinding for format detection
8	coreaudio: add a way to choose devices with number
9	Patch for Ticket 327
10	Fixing ticket 325, possible integer overflow (addition) in sox-fmt.c function startread
13	rewrite the manpages in mdoc(7)
14	sox spectrogram: remove arbitrary size limits, add normalize flag, use fftw3
15	more channels for dat files
16	remove the test suite
17	don't leak comments on failed open_{read,write}
18	hcom: validate dicsize, don't leak dictionary
19	voc validate bits per word
20	wav: bits per sample cannot be zero
21	aiff: don't write a silly number of channels
22	validate channels and rate
23	sphere: do not underflow
24	get device name properly on macOS
25	macOS build is like any other

Feature requests on sox.sf.net

Feature	Issue
236 Citation form	#266
235 Respect LD_LIBRARY_PATH for handler loading	#295
234 Can Normalization Be Dom Independently For Each Channel	#512
233 macos: curl not wget	#168
232 Audio libraries	-
231 OptimFROG (ofr) Support	#192
230 Support overlapping fade effect	#513
229 Monkeys Audio (APE) Support	#193
228 Remix: Arbitrary select channels from each input file	#514
227 The length of output data is not reported for sox_open_mem_write()	#515
226 Seekable support in sox_open_memstream_write() and sox_open_mem_write()	#516
225 Spectrogram - Log/MEL/Bark frequency scaling options	Log: #165 MEL/Bark: #267
224 Support arbitrary bits number. (ie: -b 20 )
223 Get in-file loop information
221 Implement DSF support	#44
220 GUI Frontend	-
219 SAPI event data (EVNT chunk)
216 Equalizer and Convolution (FIR) of stereo files.
215 rate with multiply/​divide of sampling rate
214 Comment in spectrogram not supporting non-ASCII
213 Add mp3 support by default as it became patent free on 16 April 2017
212 Convolver
211 use passband and move in frequency
210 Add .xtr audio file format
208 export phase info as png via spectrogram
207 spectogram to svg
206 Add codec2 for low bitrate voice as a replacement for LPC-10.
205 Feature request - default audio device	#521
204 sox.html	-
203 Support for M4A?	#198
202 Support "pcm" format of the game "Dracula X" (sega saturn)
201 Add sound meter features
200 adp format request for conversion	#523
199 simpler standalone binary please	-
198 fixed normalization	-
197 SetRecordingDurationBySox
196 fade based on previous and next file in concatenation of audio files
195 Display audio properties and spectrogram settings in spectrograms
194 Enable AMR-WB encoding support in SoX
193 Spectrum of Frequencies into dat file
192 Opus File Encoding Support
190 Save spectrograms as text file
189 Reading Support (or more) for DTS-HD
188 new release with opus file reading support?	-
187 Square (U parabola) fade
183 soxi to JSON
181 Can't read Large Wave files (No Header)
180 Higher Precision with Speed.
179 append to tags
178 Waveform Display for SoX
177 WavPack ReplayGain support
176 Log Frequency Scale for Spectrogram	#165
175 Use pkg-config for all library detection
174 Sidechain functionality for compand/​mcompand effects
173 dsd to pcm support	#44
172 logarithmic fade only spans across half the fade-out-length
170 alpha channel for spectrograms
168 wish: raw, realtime spectrogram data (graphical equaliser)
167 Statistics: EBU R128 specifications	#151
166 SoX for WinCE	#522
165 Better directory support
164 play: interactive selection of output channels
163 Apply effects to specific channels only
162 Plot combined response of cascaded filters
161 time stretch with DIRAC alg.
156 v4.13 Fake temporary files in Windows
154 ima-adpcm in RAW
153 New feature: using a profile for highpass/​lowpass filter
150 Tape wow and flutter correction
149 Request for Project Wiki
147 Deliver libsox.dll for win32
146 Will G.723 (111) be added for wav files?
145 Request for different tunings in synth
144 Mac OS X binaries info
141 Stereo center removal (not oops)
135 CAF with IMA4 support
134 Monkey's Audio decoding support	#193
129 Add sox_add_effect_with_auto() utility
128 Do not export lsx_ symbols in libsox
127 Allow inputs to have different rates while concat'ing
125 Split existing speech file on silence
124 Fade out should allow stop-time="end of the file" with pipes
123 Support DDWAV files
122 Error handling .ACT wav files
121 soxrc
119 RMS Normlization
117 Format lists in --help text
113 dynamic SoX Effects
109 sox as vst plugin
108 OSS plugin should support 24 and 32 bit formats
103 Support .mpc
102 Support for .act
101 Support .ape
99 Replace or supplement use of wget with (lib)curl	(#112) #168
96 Push file detection into libmagic and use that
95 Separate formats and CODECs

The 182 commits on sox.sf.net since 14.4.2

These are from h3nd24-sox:

sox.sf.net commit	Description
2f6b3fec	riaa: add support for 192k sample rate
5761edbc	win32-glob: fix resource leak on bad pattern
2ce02fea	fix possible null pointer deref in lsx_make_lpf() (CVE-2019-8357)
b7883ae1	fft4g: bail if size too large (CVE-2019-8356)
f8587e2d	fix possible overflow in lsx_(re)valloc() size calculation (CVE-2019-8355)
f7091126	fix possible buffer size overflow in lsx_make_lpf() (CVE-2019-8354)
ccedd088	Clean up lsx_malloc() and friends
03b4667b	sox: use sigaction where available [bug #214]
ec073861	make: update exported symbol list [bug #266]
491c2bb2	hcom: report input file length
35fa4b6c	hcom: fix writing absurdly large files
5735eaec	hcom: limit input size to 2G samples
18d2609a	hcom: fix pointer type confusion [bug #308]
998208fd	hcom: fix double free on writing zero-length file
1968a7f0	wav: check for block align overflow [bug #279]
6b6a2930	wav: disallow zero-size chunks [bug #278]
8c2be5c7	wav: adpcm: stricter header validation [bug #265]
37e998b0	voc: abort if channel count or sample format changes [bug #265]
e81229cd	aiff: fix handling of unknown odd-sized chunks [bug #286]
9b27bc7f	amr: check for invalid block types [bug #305]
9c12c40e	oss: prefer stereo mode [bug #300]
342d3e71	oss: fix input buffer overrun [bug #300]
9923bcf0	msvc: fix build with Visual Studio 2015 [bug #282]
4b547a07	doc: fix doubled pdf output [bug #261]
7bfb3d8c	doc: fix out of tree text/pdf/html generation
228a5709	doc: fix obsolete example in INSTALL file [bug #257]
db1c5a45	spelling fixes
000b31b9	update FSF mailing address [bug #301]
8dcd32b1	delete debian packaging files [bug #270]
0d70a21c	make: add $(DESTDIR) in installcheck target [bug #302]
09d7388c	xa: validate channel count (CVE-2017-18189)
f56c0dbc	aiff: fix crash on empty comment chunk (CVE-2017-15642)
515b9861	adpcm: fix stack overflow with >4 channels (CVE-2017-15372)
968c689a	flac: fix crash on corrupt metadata (CVE-2017-15371)
e076a7ad	wav: ima_adpcm: fix buffer overflow on corrupt input (CVE-2017-15370)
7b3f30e1	wav: fix crash writing header when channel count >64k (CVE-2017-11359)
e410d00c	hcom: fix crash on input with corrupt dictionary (CVE-2017-11358)
6e177c45	wav: fix crash if channel count is zero (CVE-2017-11332)
7e74b254	Remove hepler script. It's mostly unmaintained, I don't know if anyone but me ever used it. In any case, those who want a custom Debian package should be capable of updating the debian/changelog entry on their own.
19bdf7ef	chmod'ing unneeded executable bit.
e9189be4	Merge most Debian changes into master.
cfc3ccc2	Read for more development.
d41836d3	Fixes for issues found during 14.4.2 release.
45b161d7	sox-14.4.2 release

Commit	Description	Issue
3518bcd	Define sox_intN_t types using standard intN_t	#249

To be added

Other patches from the Distros

Among which:

• haiku One patch for haiku
• MacPorts Two patches:
  • Fix build on Yosemite
• Mageia 7 CVE patches
• OpenEuler 12 patches
• OpenIndiana 3 patches:
  • formats.c: update to 14.4.2; drop 32 bit
  • libsox.c: avoid dependencies on encumbered packages
  • disableencumbered: update to 14.4.2; drop 32 bit
• pkgsrc
  • patch-src_oss.c: Prevent a segfault when playing certain WAV files. From Onno van ...
  • patch-src_sox.c: PR pkg/56800 hitting v or V during sox's play command causes a segfault from On...
  • patch-src_sunaudio.c: PR pkg/56800 hitting v or V during sox's play command causes a segfault from On...
• PLD Linux 3 patches:
  • sox-dyn
  • sox-link
  • sos-system-lpc10
• Redhat bug tracker
• Ubuntu bug tracker

Other

• Cannot play/record under Windows fails in 14.4.2, works in 14.4.1
• release.sh is said not to work