This patch is taken from opensuse: 
https://build.opensuse.org/package/show/multimedia:libs/audiofile

CVE: CVE-2019-13147
Upstream-Status: Inactive-Upstream [lastcommit: 2016-Aug-30]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>

diff --unified --recursive --text --new-file --color audiofile-0.3.6/libaudiofile/NeXT.cpp audiofile-0.3.6.new/libaudiofile/NeXT.cpp
--- audiofile-0.3.6/libaudiofile/NeXT.cpp	2013-03-06 13:30:03.000000000 +0800
+++ audiofile-0.3.6.new/libaudiofile/NeXT.cpp	2025-05-14 10:45:11.685700984 +0800
@@ -32,6 +32,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 
 #include "File.h"
 #include "Setup.h"
@@ -122,6 +123,12 @@
 		_af_error(AF_BAD_CHANNELS, "invalid file with 0 channels");
 		return AF_FAIL;
 	}
+	/* avoid overflow of INT for double size rate */
+	if (channelCount > (INT32_MAX / (sizeof(double))))
+	{
+		_af_error(AF_BAD_CHANNELS, "invalid file with %i channels", channelCount);
+		return AF_FAIL;
+	}
 
 	Track *track = allocateTrack();
 	if (!track)