diff --git a/taglib/mpc/mpcproperties.cpp b/taglib/mpc/mpcproperties.cpp index f11f8ecf..a162b8ee 100644 --- a/taglib/mpc/mpcproperties.cpp +++ b/taglib/mpc/mpcproperties.cpp @@ -197,10 +197,15 @@ void MPC::Properties::readSV8(File *file) unsigned long packetSize = readSize(file, packetSizeLength); unsigned long dataSize = packetSize - 2 - packetSizeLength; + const ByteVector data = file->readBlock(dataSize); + if(data.size() != dataSize) { + debug("MPC::Properties::readSV8() - dataSize doesn't match the actual data size."); + break; + } + if(packetType == "SH") { // Stream Header // http://trac.musepack.net/wiki/SV8Specification#StreamHeaderPacket - ByteVector data = file->readBlock(dataSize); readSH = true; TagLib::uint pos = 4; @@ -225,7 +230,6 @@ void MPC::Properties::readSV8(File *file) else if (packetType == "RG") { // Replay Gain // http://trac.musepack.net/wiki/SV8Specification#ReplaygainPacket - ByteVector data = file->readBlock(dataSize); readRG = true; int replayGainVersion = data[0]; diff --git a/tests/data/infloop.mpc b/tests/data/infloop.mpc new file mode 100644 index 00000000..46861ab3 Binary files /dev/null and b/tests/data/infloop.mpc differ diff --git a/tests/test_mpc.cpp b/tests/test_mpc.cpp index d7239a6d..c79d0a8c 100644 --- a/tests/test_mpc.cpp +++ b/tests/test_mpc.cpp @@ -18,6 +18,7 @@ class TestMPC : public CppUnit::TestFixture CPPUNIT_TEST(testPropertiesSV5); CPPUNIT_TEST(testPropertiesSV4); CPPUNIT_TEST(testFuzzedFile1); + CPPUNIT_TEST(testFuzzedFile2); CPPUNIT_TEST_SUITE_END(); public: @@ -68,6 +69,12 @@ public: CPPUNIT_ASSERT(f.isValid()); } + void testFuzzedFile2() + { + MPC::File f(TEST_FILE_PATH_C("infloop.mpc")); + CPPUNIT_ASSERT(f.isValid()); + } + }; CPPUNIT_TEST_SUITE_REGISTRATION(TestMPC);