From 2e9cac7307ec41c523ae7b80f14ee9af967a8231 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Tue, 4 Aug 2026 00:12:57 -0400
Subject: [PATCH] Xiph: limit parsed comment fields (#1397)

Xiph comment parsing retained an unbounded number of fields. A
crafted comment block with many small fields could consume
disproportionate memory.

Stop parsing comment fields when the parser limit is exceeded.
---
 taglib/ogg/xiphcomment.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/taglib/ogg/xiphcomment.cpp b/taglib/ogg/xiphcomment.cpp
index 6c31462e..8218b7aa 100644
--- a/taglib/ogg/xiphcomment.cpp
+++ b/taglib/ogg/xiphcomment.cpp
@@ -422,6 +422,8 @@ ByteVector Ogg::XiphComment::render(bool addFramingBit) const
 
 void Ogg::XiphComment::parse(const ByteVector &data)
 {
+  static constexpr unsigned int MAX_XIPH_COMMENT_FIELD_COUNT = 50000;
+
   // The first thing in the comment data is the vendor ID length, followed by a
   // UTF8 string with the vendor ID.
 
@@ -438,7 +440,9 @@ void Ogg::XiphComment::parse(const ByteVector &data)
   const unsigned int commentFields = data.toUInt(pos, false);
   pos += 4;
 
-  if(commentFields > (data.size() - 8) / 4) {
+  if(commentFields > MAX_XIPH_COMMENT_FIELD_COUNT ||
+     commentFields > (data.size() - 8) / 4) {
+    debug("Ogg::XiphComment::parse() - Maximum comment field count exceeded.");
     return;
   }