mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-05-27 21:20:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Avoid an infinite loop when reading fuzzed WavPack files. (#482)

Browse Source
This commit is contained in:
Tsuda Kageyu 2015-05-22 14:11:06 +09:00
parent 0ea22348cb
commit 3094540a4b
3 changed files with 24 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
taglib/wavpack/wavpackproperties.cpp
View File

@ -176,28 +176,25 @@ void WavPack::Properties::read()
unsigned int WavPack::Properties::seekFinalIndex()
{
ByteVector blockID("wvpk", 4);
const long offset = d->file->rfind("wvpk", d->streamLength);
if(offset == -1)
return 0;
long offset = d->streamLength;
while(offset > 0) {
offset = d->file->rfind(blockID, offset);
if(offset == -1)
return 0;
d->file->seek(offset);
ByteVector data = d->file->readBlock(32);
if(data.size() != 32)
return 0;
const int version = data.toShort(8, false);
if(version < MIN_STREAM_VERS || version > MAX_STREAM_VERS)
continue;
const unsigned int flags = data.toUInt(24, false);
if(!(flags & FINAL_BLOCK))
return 0;
const unsigned int blockIndex = data.toUInt(16, false);
const unsigned int blockSamples = data.toUInt(20, false);
return blockIndex + blockSamples;
}
d->file->seek(offset);
const ByteVector data = d->file->readBlock(32);
if(data.size() < 32)
return 0;
return 0;
const int version = data.toShort(8, false);
if(version < MIN_STREAM_VERS || version > MAX_STREAM_VERS)
return 0;
const unsigned int flags = data.toUInt(24, false);
if(!(flags & FINAL_BLOCK))
return 0;
const unsigned int blockIndex = data.toUInt(16, false);
const unsigned int blockSamples = data.toUInt(20, false);
return blockIndex + blockSamples;
}

BIN
tests/data/infloop.wv Normal file
View File

Binary file not shown.

5
tests/test_wavpack.cpp
View File

@ -35,6 +35,11 @@ public:
CPPUNIT_ASSERT_EQUAL(4, props->length());
}
void testFuzzedFile()
{
WavPack::File f(TEST_FILE_PATH_C("infloop.wv"));
CPPUNIT_ASSERT(f.isValid());
}
};
CPPUNIT_TEST_SUITE_REGISTRATION(TestWavPack);