diff --git a/taglib/asf/asffile.cpp b/taglib/asf/asffile.cpp index b68ea2a2..bba49663 100644 --- a/taglib/asf/asffile.cpp +++ b/taglib/asf/asffile.cpp @@ -686,16 +686,22 @@ void ASF::File::read() setValid(false); return; } - int numObjects = readDWORD(this, &ok); + static constexpr unsigned int MAX_ASF_HEADER_OBJECT_COUNT = 50000; + const unsigned int numObjects = readDWORD(this, &ok); if(!ok) { setValid(false); return; } + if(numObjects > MAX_ASF_HEADER_OBJECT_COUNT) { + debug("ASF::File::read(): Maximum header object count exceeded."); + setValid(false); + return; + } seek(2, Current); FilePrivate::FilePropertiesObject *filePropertiesObject = nullptr; FilePrivate::StreamPropertiesObject *streamPropertiesObject = nullptr; - for(int i = 0; i < numObjects; i++) { + for(unsigned int i = 0; i < numObjects; i++) { const ByteVector guid = readBlock(16); if(guid.size() != 16) { setValid(false);