mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-08-14 06:17:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

ASF: limit header object count (#1395)

Browse Source 
ASF header parsing retained an unbounded number of objects. A crafted
file with many small objects could consume disproportionate memory.

Reject files whose header object count exceeds the parser limit.
This commit is contained in:
Acts1631
2026-08-03 18:46:01 +02:00
committed by GitHub
parent a1d0488dc6
commit 2ada48a77f
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglib/asf/asffile.cpp
+8 -2
View File
@@ -686,16 +686,22 @@ void ASF::File::read()
setValid(false);
return;
}
int numObjects = readDWORD(this, &ok);
static constexpr unsigned int MAX_ASF_HEADER_OBJECT_COUNT = 50000;
const unsigned int numObjects = readDWORD(this, &ok);
if(!ok) {
setValid(false);
return;
}
if(numObjects > MAX_ASF_HEADER_OBJECT_COUNT) {
debug("ASF::File::read(): Maximum header object count exceeded.");
setValid(false);
return;
}
seek(2, Current);
FilePrivate::FilePropertiesObject *filePropertiesObject = nullptr;
FilePrivate::StreamPropertiesObject *streamPropertiesObject = nullptr;
for(int i = 0; i < numObjects; i++) {
for(unsigned int i = 0; i < numObjects; i++) {
const ByteVector guid = readBlock(16);
if(guid.size() != 16) {
setValid(false);