mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-08-14 06:17:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

APE: limit parsed tag item count (#1411)

Browse Source 
An APEv2 footer controls the number of parsed items without a bound.
A small crafted tag can therefore allocate a large item map and terminate
a memory-constrained application.

Stop parsing after 50,000 items. This matches existing parser count limits
and preserves entries parsed before the limit.
This commit is contained in:
Acts1631
2026-08-14 06:07:47 +02:00
committed by GitHub
parent 77f5477609
commit 766471a5a4
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglib/ape/apetag.cpp
+6
View File
@@ -49,6 +49,7 @@ namespace
{
constexpr unsigned int MinKeyLength = 2;
constexpr unsigned int MaxKeyLength = 255;
constexpr unsigned int MAX_APE_ITEM_COUNT = 50000;
const String FRONT_COVER("COVER ART (FRONT)");
const String BACK_COVER("COVER ART (BACK)");
@@ -471,6 +472,11 @@ void APE::Tag::parse(const ByteVector &data)
for(unsigned int i = 0; i < d->footer.itemCount() && pos <= data.size() - 11; i++) {
if(i >= MAX_APE_ITEM_COUNT) {
debug("APE::Tag::parse() - Maximum item count exceeded. Stopped parsing.");
return;
}
const int nullPos = data.find('\0', pos + 8);
if(nullPos < 0) {
debug("APE::Tag::parse() - Couldn't find a key/value separator. Stopped parsing.");