mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-08-14 06:17:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

Xiph: limit parsed comment fields (#1397)

Browse Source 
Xiph comment parsing retained an unbounded number of fields. A
crafted comment block with many small fields could consume
disproportionate memory.

Stop parsing comment fields when the parser limit is exceeded.
This commit is contained in:
Acts1631
2026-08-04 06:12:57 +02:00
committed by GitHub
parent eb4ba7e93b
commit 2e9cac7307
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglib/ogg/xiphcomment.cpp
+5 -1
View File
@@ -422,6 +422,8 @@ ByteVector Ogg::XiphComment::render(bool addFramingBit) const
void Ogg::XiphComment::parse(const ByteVector &data)
{
static constexpr unsigned int MAX_XIPH_COMMENT_FIELD_COUNT = 50000;
// The first thing in the comment data is the vendor ID length, followed by a
// UTF8 string with the vendor ID.
@@ -438,7 +440,9 @@ void Ogg::XiphComment::parse(const ByteVector &data)
const unsigned int commentFields = data.toUInt(pos, false);
pos += 4;
if(commentFields > (data.size() - 8) / 4) {
if(commentFields > MAX_XIPH_COMMENT_FIELD_COUNT ||
commentFields > (data.size() - 8) / 4) {
debug("Ogg::XiphComment::parse() - Maximum comment field count exceeded.");
return;
}