ID3v2: limit parsed frame count (#1406)

Bound top-level ID3v2 parsing to 50000 frames. Crafted tags with
many small frames could otherwise consume excessive memory and crash
applications.

Stop parsing further frames after the limit while retaining the
successfully parsed tag data.

taglib/mpeg/id3v2/id3v2tag.cpp

@@ -56,6 +56,7 @@ namespace
 
   constexpr long MinPaddingSize = 1024;
   constexpr long MaxPaddingSize = 1024 * 1024;
+  constexpr unsigned int MAX_ID3V2_FRAME_COUNT = 50000;
 
   /*!
    * Downgrade ID3v2.4 text \a encoding to value supported by ID3v2.3.
@@ -834,6 +835,7 @@ void ID3v2::Tag::parse(const ByteVector &origData)
 
   unsigned int frameDataPosition = 0;
   unsigned int frameDataLength = data.size();
+  unsigned int frameCount = 0;
 
   // check for extended header
 
@@ -871,6 +873,11 @@ void ID3v2::Tag::parse(const ByteVector &origData)
       break;
     }
 
+    if(frameCount++ >= MAX_ID3V2_FRAME_COUNT) {
+      debug("ID3v2::Tag::parse() -- Maximum frame count exceeded");
+      break;
+    }
+
     const ByteVector origData = data.mid(frameDataPosition);
     const Header *tagHeader = &d->header;
     unsigned int headerVersion = tagHeader->majorVersion();