A heap-based buffer over-read at wav.c in wavwriteheader that could be used for a denial of service attack (CVE-2018-19758).