rvqcodec is pre-1.0; only the latest released version on the default branch receives fixes.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
Please report suspected vulnerabilities privately via GitHub's security advisories rather than opening a public issue.
Include what you were doing, what happened, and enough detail to reproduce. You can expect an initial acknowledgement within a few days.
The library parses two kinds of untrusted input: WAV files and .rvq
bitstreams. The container reader validates its header (magic, version, and code
counts) before allocating, but as with any parser, treat inputs from untrusted
sources with care. Reports about crashes or unbounded allocation triggered by
malformed input are in scope and welcome.