Commit 3fefea5d94 for qemu.org

commit 3fefea5d948da883f3b11086d14d401e921395c9
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:26 2026 +0400

    audio/wavcapture: prevent freq overflow and corrupted WAV header

    Reject freq <= 0 in wav_start_capture() early, before it is used to
    compute the WAV header fields.

    Reported-by: Hui Peng <benquike@gmail.com>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-12-ccbef537cbeb@redhat.com>

diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 2dac946171..67bac380ac 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -131,6 +131,12 @@ int wav_start_capture(AudioBackend *state, CaptureState *s, const char *path,
         return -1;
     }

+    if (freq <= 0 || freq > 384000) {
+        error_report("invalid frequency %d, must be between 1 and 384000",
+                     freq);
+        return -1;
+    }
+
     stereo = nchannels == 2;
     bits16 = bits == 16;