Process-memory disclosure via uninitialized format write

Use of uninitialized data in wav_format_write in libwav through 2017-04-20 allows attackers to disclose process memory in WAV output. The function passes the entire wav_format structure to fwrite, including bytes left uninitialized, so residual process memory enters the output stream. Exploitation requires a caller to process attacker-controlled WAV data and expose the generated output; the demonstrated consequence is memory disclosure.