[Security] Negative-index global-buffer-overflow in plm_audio_decode_header (bitrate_index == -1)

[eobi]

[Security] Global-buffer-overflow (negative index) in plm_audio_decode_header

Summary

plm_audio_decode_header reads PLM_AUDIO_BIT_RATE[self->bitrate_index] with
bitrate_index == -1 when the 4-bit bitrate field of an MP2 audio header is 0
(MPEG "free format"). The existing guard checks only the upper bound, so the negative
index reads one short before the global table — a global-buffer-overflow (ASan:
"READ of size 2 ... global-buffer-overflow"). Reachable from the public API
(plm_decode_audio, and also during plm_create_with_memory decoder init).

Affected

pl_mpeg.h @ current master. Independent of, and in a different function than, the open
audio issues #68 (plm_audio_decode_frame) and #69 (plm_audio_find_frame_sync); after
applying the fix below, #69 still reproduces, confirming they are distinct.

Root cause (pl_mpeg.h ~line 4028)

int bitrate_index = plm_buffer_read(self->buffer, 4) - 1;  // 4-bit 0 -> -1
if (bitrate_index > 13) { return 0; }                      // upper bound ONLY
...
int bitrate = PLM_AUDIO_BIT_RATE[self->bitrate_index];     // PLM_AUDIO_BIT_RATE[-1]

Fix (one line)

if (bitrate_index < 0 || bitrate_index > 13) { return 0; }

Verified: reproducer no longer faults, valid streams still decode, 90s re-fuzz does not
reproduce (it then finds the separate, already-reported #69).

Reproducer

57-byte MP2 stream attached (repro.mpg). ASan trace in asan.txt.

Credit

Found with an automatically generated fuzz harness (harness-forge) + libFuzzer/ASan.