From fff8359875d6cd95cdb78cf75b2b20a10ad399bb Mon Sep 17 00:00:00 2001
From: tonghuaroot <tonghuaroot@gmail.com>
Date: Mon, 13 Jul 2026 10:43:25 +0800
Subject: [PATCH 1/2] gh-153692: Raise wave.Error for a truncated fmt chunk in
 wave.open

wave.open(f, 'rb') is documented to raise wave.Error for a file that violates
the WAV format, but Wave_read.initfp() let the EOFError raised by
_read_fmt_chunk() on a truncated fmt chunk escape raw. Wrap that call so a
truncated fmt chunk raises wave.Error, matching every other malformed-input
path in the module.
---
 Lib/test/test_wave.py                                      | 7 +++++++
 Lib/wave.py                                                | 5 ++++-
 .../Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst | 2 ++
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst

diff --git a/Lib/test/test_wave.py b/Lib/test/test_wave.py
index d3723c04820d9d..2f7e4e36109c54 100644
--- a/Lib/test/test_wave.py
+++ b/Lib/test/test_wave.py
@@ -333,6 +333,13 @@ def test_read_wrong_sample_width(self):
         with self.assertRaisesRegex(wave.Error, 'bad sample width'):
             wave.open(io.BytesIO(b))
 
+    def test_read_truncated_fmt_chunk(self):
+        b = b'RIFF' + struct.pack('<L', 24) + b'WAVE'
+        b += b'fmt ' + struct.pack('<L', 16)
+        b += struct.pack('<HHLLH', 1, 1, 11025, 11025, 1)
+        with self.assertRaisesRegex(wave.Error, 'fmt chunk is truncated'):
+            wave.open(io.BytesIO(b))
+
     def test_open_in_write_raises(self):
         # gh-136523: Wave_write.__del__ should not throw
         with support.catch_unraisable_exception() as cm:
diff --git a/Lib/wave.py b/Lib/wave.py
index c4e1a493a7ec7f..205373228eed36 100644
--- a/Lib/wave.py
+++ b/Lib/wave.py
@@ -278,7 +278,10 @@ def initfp(self, file):
                 break
             chunkname = chunk.getname()
             if chunkname == b'fmt ':
-                self._read_fmt_chunk(chunk)
+                try:
+                    self._read_fmt_chunk(chunk)
+                except EOFError:
+                    raise Error('fmt chunk is truncated') from None
                 self._fmt_chunk_read = 1
             elif chunkname == b'data':
                 if not self._fmt_chunk_read:
diff --git a/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst b/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst
new file mode 100644
index 00000000000000..ea5ed07c7d320c
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst
@@ -0,0 +1,2 @@
+:func:`wave.open` now raises :exc:`wave.Error` instead of :exc:`EOFError` when
+the ``fmt `` chunk of a WAV file is truncated.  Patch by tonghuaroot.

From 07590a2f41230c02c644a8e0a25f303a43a8c39d Mon Sep 17 00:00:00 2001
From: tonghuaroot <tonghuaroot@gmail.com>
Date: Tue, 14 Jul 2026 17:31:15 +0800
Subject: [PATCH 2/2] gh-153692: Fix the NEWS inline literal (drop trailing
 space in fmt)

---
 .../next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst b/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst
index ea5ed07c7d320c..e6f5bbb6c54e04 100644
--- a/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst
+++ b/Misc/NEWS.d/next/Library/2026-07-13-10-43-04.gh-issue-153692.ouFZC9.rst
@@ -1,2 +1,2 @@
 :func:`wave.open` now raises :exc:`wave.Error` instead of :exc:`EOFError` when
-the ``fmt `` chunk of a WAV file is truncated.  Patch by tonghuaroot.
+the ``fmt`` chunk of a WAV file is truncated. Patch by tonghuaroot.