From 2ada48a77f9b5158f6a4313ed7a90de8efc4eb75 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:46:01 -0400
Subject: [PATCH] ASF: limit header object count (#1395)

ASF header parsing retained an unbounded number of objects. A crafted
file with many small objects could consume disproportionate memory.

Reject files whose header object count exceeds the parser limit.
---
 taglib/asf/asffile.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/taglib/asf/asffile.cpp b/taglib/asf/asffile.cpp
index b68ea2a2..bba49663 100644
--- a/taglib/asf/asffile.cpp
+++ b/taglib/asf/asffile.cpp
@@ -686,16 +686,22 @@ void ASF::File::read()
     setValid(false);
     return;
   }
-  int numObjects = readDWORD(this, &ok);
+  static constexpr unsigned int MAX_ASF_HEADER_OBJECT_COUNT = 50000;
+  const unsigned int numObjects = readDWORD(this, &ok);
   if(!ok) {
     setValid(false);
     return;
   }
+  if(numObjects > MAX_ASF_HEADER_OBJECT_COUNT) {
+    debug("ASF::File::read(): Maximum header object count exceeded.");
+    setValid(false);
+    return;
+  }
   seek(2, Current);
 
   FilePrivate::FilePropertiesObject   *filePropertiesObject   = nullptr;
   FilePrivate::StreamPropertiesObject *streamPropertiesObject = nullptr;
-  for(int i = 0; i < numObjects; i++) {
+  for(unsigned int i = 0; i < numObjects; i++) {
     const ByteVector guid = readBlock(16);
     if(guid.size() != 16) {
       setValid(false);