From 6d9429b12160524f347bfde369cff3c01b561f44 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:19:52 -0400
Subject: [PATCH] ID3v2: limit parsed frame count (#1406)

Bound top-level ID3v2 parsing to 50000 frames. Crafted tags with
many small frames could otherwise consume excessive memory and crash
applications.

Stop parsing further frames after the limit while retaining the
successfully parsed tag data.
---
 taglib/mpeg/id3v2/id3v2tag.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/taglib/mpeg/id3v2/id3v2tag.cpp b/taglib/mpeg/id3v2/id3v2tag.cpp
index 75a60ca3..6fc7ade1 100644
--- a/taglib/mpeg/id3v2/id3v2tag.cpp
+++ b/taglib/mpeg/id3v2/id3v2tag.cpp
@@ -56,6 +56,7 @@ namespace
 
   constexpr long MinPaddingSize = 1024;
   constexpr long MaxPaddingSize = 1024 * 1024;
+  constexpr unsigned int MAX_ID3V2_FRAME_COUNT = 50000;
 
   /*!
    * Downgrade ID3v2.4 text \a encoding to value supported by ID3v2.3.
@@ -834,6 +835,7 @@ void ID3v2::Tag::parse(const ByteVector &origData)
 
   unsigned int frameDataPosition = 0;
   unsigned int frameDataLength = data.size();
+  unsigned int frameCount = 0;
 
   // check for extended header
 
@@ -871,6 +873,11 @@ void ID3v2::Tag::parse(const ByteVector &origData)
       break;
     }
 
+    if(frameCount++ >= MAX_ID3V2_FRAME_COUNT) {
+      debug("ID3v2::Tag::parse() -- Maximum frame count exceeded");
+      break;
+    }
+
     const ByteVector origData = data.mid(frameDataPosition);
     const Header *tagHeader = &d->header;
     unsigned int headerVersion = tagHeader->majorVersion();