diff --git a/taglib/riff/wav/wavproperties.cpp b/taglib/riff/wav/wavproperties.cpp index 8062df5f..439a1954 100644 --- a/taglib/riff/wav/wavproperties.cpp +++ b/taglib/riff/wav/wavproperties.cpp @@ -115,6 +115,11 @@ TagLib::uint RIFF::WAV::Properties::sampleFrames() const void RIFF::WAV::Properties::read(const ByteVector &data) { + if(data.size() < 16) { + debug("RIFF::WAV::Properties::read() - \"fmt \" chunk is too short for WAV."); + return; + } + d->format = data.toShort(0, false); d->channels = data.toShort(2, false); d->sampleRate = data.toUInt(4, false); diff --git a/tests/data/segfault.wav b/tests/data/segfault.wav new file mode 100644 index 00000000..0385e99b Binary files /dev/null and b/tests/data/segfault.wav differ diff --git a/tests/test_wav.cpp b/tests/test_wav.cpp index b0073ebc..72efe4f6 100644 --- a/tests/test_wav.cpp +++ b/tests/test_wav.cpp @@ -72,8 +72,11 @@ public: void testFuzzedFiles() { - RIFF::WAV::File f(TEST_FILE_PATH_C("infloop.wav")); - CPPUNIT_ASSERT(!f.isValid()); + RIFF::WAV::File f1(TEST_FILE_PATH_C("infloop.wav")); + CPPUNIT_ASSERT(!f1.isValid()); + + RIFF::WAV::File f2(TEST_FILE_PATH_C("segfault.wav")); + CPPUNIT_ASSERT(f2.isValid()); } };