Code: header_seek (SF_PRIVATE *psf, sf_count_t position, int whence)
 {
 	switch (whence)
 	{	case SEEK_SET :
			if (position > SIGNED_SIZEOF (psf->header))
 			{	/* Too much header to cache so just seek instead. */
 				psf_fseek (psf, position, whence) ;
 				return ;
 				} ;
			if (position > psf->headend)
				psf->headend += psf_fread (psf->header + psf->headend, 1, position - psf->headend, psf) ;
			psf->headindex = position ;
 			break ;
 
 		case SEEK_CUR :
			if (psf->headindex + position < 0)
 				break ;
 
			if (psf->headindex >= SIGNED_SIZEOF (psf->header))
 			{	psf_fseek (psf, position, whence) ;
 				return ;
 				} ;
 
			if (psf->headindex + position <= psf->headend)
			{	psf->headindex += position ;
 				break ;
 				} ;
 
			if (psf->headindex + position > SIGNED_SIZEOF (psf->header))
 			{	/* Need to jump this without caching it. */
				psf->headindex = psf->headend ;
 				psf_fseek (psf, position, SEEK_CUR) ;
 				break ;
 				} ;
 
			psf->headend += psf_fread (psf->header + psf->headend, 1, position - (psf->headend - psf->headindex), psf) ;
			psf->headindex = psf->headend ;
 			break ;
 
 		case SEEK_END :
		default :
			psf_log_printf (psf, "Bad whence param in header_seek().\n") ;
			break ;
		} ;

	return ;
} /* header_seek */

Vulnerability Type: Overflow 
CWE ID: CWE-119
Summary: In libsndfile before 1.0.28, an error in the *header_read()* function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
Commit Message: src/ : Move to a variable length header buffer

Previously, the `psf->header` buffer was a fixed length specified by
`SF_HEADER_LEN` which was set to `12292`. This was problematic for
two reasons; this value was un-necessarily large for the majority
of files and too small for some others.

Now the size of the header buffer starts at 256 bytes and grows as
necessary up to a maximum of 100k.