Validate Ogg page bounds before saving (#1491)

Ogg page lacing values can declare payload beyond EOF. During an
in-memory tag update, that replacement span can underflow the length
passed to memmove and crash the process.

Reject truncated pages and make ByteVectorStream::insert ignore invalid
replacement ranges before doing offset arithmetic.

taglib/ogg/oggpageheader.cpp

@@ -272,6 +272,13 @@ void Ogg::PageHeader::read(Ogg::File *file, offset_t pageOffset)
   else
     d->lastPacketCompleted = true;
 
+  const offset_t streamLength = file->length();
+  if(streamLength < 0 || pageOffset > streamLength ||
+     d->size + d->dataSize > streamLength - pageOffset) {
+    debug("Ogg::PageHeader::read() -- page data exceeds stream length");
+    return;
+  }
+
   d->isValid = true;
 }
 

taglib/toolkit/tbytevectorstream.cpp

@@ -27,6 +27,7 @@
 
 #include <cstring>
 
+#include "tdebug.h"
 #include "tstring.h"
 
 using namespace TagLib;
@@ -82,7 +83,15 @@ void ByteVectorStream::writeBlock(const ByteVector &data)
 
 void ByteVectorStream::insert(const ByteVector &data, offset_t start, size_t replace)
 {
-  offset_t sizeDiff = data.size() - replace;
+  const offset_t streamLength = length();
+  if(start < 0 || start > streamLength ||
+     replace > static_cast<size_t>(streamLength - start)) {
+    debug("ByteVectorStream::insert() -- replacement range is out of bounds");
+    return;
+  }
+
+  const offset_t sizeDiff = static_cast<offset_t>(data.size()) -
+                            static_cast<offset_t>(replace);
   if(sizeDiff < 0) {
     removeBlock(start + data.size(), -sizeDiff);
   }