diff --git a/taglib/ogg/flac/oggflacfile.cpp b/taglib/ogg/flac/oggflacfile.cpp index bdf82459..1258e705 100644 --- a/taglib/ogg/flac/oggflacfile.cpp +++ b/taglib/ogg/flac/oggflacfile.cpp @@ -103,7 +103,7 @@ PropertyMap Ogg::FLAC::File::properties() const PropertyMap Ogg::FLAC::File::setProperties(const PropertyMap &properties) { return d->comment->setProperties(properties); -} +} Properties *Ogg::FLAC::File::audioProperties() const { @@ -211,29 +211,30 @@ void Ogg::FLAC::File::scan() long overhead = 0; ByteVector metadataHeader = packet(ipacket); - if(metadataHeader.isNull()) + if(metadataHeader.isEmpty()) return; - ByteVector header; - - if (!metadataHeader.startsWith("fLaC")) { + if(!metadataHeader.startsWith("fLaC")) { // FLAC 1.1.2+ - if (metadataHeader.mid(1,4) != "FLAC") return; + if(metadataHeader.mid(1, 4) != "FLAC") + return; - if (metadataHeader[5] != 1) return; // not version 1 + if(metadataHeader[5] != 1) + return; // not version 1 metadataHeader = metadataHeader.mid(13); } else { // FLAC 1.1.0 & 1.1.1 metadataHeader = packet(++ipacket); - - if(metadataHeader.isNull()) - return; - } - header = metadataHeader.mid(0,4); + ByteVector header = metadataHeader.mid(0, 4); + if(header.size() != 4) { + debug("Ogg::FLAC::File::scan() -- Invalid Ogg/FLAC metadata header"); + return; + } + // Header format (from spec): // <1> Last-metadata-block flag // <7> BLOCK_TYPE @@ -262,11 +263,12 @@ void Ogg::FLAC::File::scan() while(!lastBlock) { metadataHeader = packet(++ipacket); - - if(metadataHeader.isNull()) - return; - header = metadataHeader.mid(0, 4); + if(header.size() != 4) { + debug("Ogg::FLAC::File::scan() -- Invalid Ogg/FLAC metadata header"); + return; + } + blockType = header[0] & 0x7f; lastBlock = (header[0] & 0x80) != 0; length = header.toUInt(1, 3, true); diff --git a/tests/data/segfault.oga b/tests/data/segfault.oga new file mode 100644 index 00000000..e23c2170 Binary files /dev/null and b/tests/data/segfault.oga differ diff --git a/tests/test_oggflac.cpp b/tests/test_oggflac.cpp index 1cdb24b0..975af44e 100644 --- a/tests/test_oggflac.cpp +++ b/tests/test_oggflac.cpp @@ -15,6 +15,7 @@ class TestOggFLAC : public CppUnit::TestFixture { CPPUNIT_TEST_SUITE(TestOggFLAC); CPPUNIT_TEST(testFramingBit); + CPPUNIT_TEST(testFuzzedFile); CPPUNIT_TEST_SUITE_END(); public: @@ -39,6 +40,12 @@ public: delete f; } + void testFuzzedFile() + { + Ogg::FLAC::File f(TEST_FILE_PATH_C("segfault.oga")); + CPPUNIT_ASSERT(!f.isValid()); + } + }; CPPUNIT_TEST_SUITE_REGISTRATION(TestOggFLAC);