diff --git a/taglib/ape/apetag.cpp b/taglib/ape/apetag.cpp index 9c359aad..f5b43f26 100644 --- a/taglib/ape/apetag.cpp +++ b/taglib/ape/apetag.cpp @@ -49,6 +49,7 @@ namespace { constexpr unsigned int MinKeyLength = 2; constexpr unsigned int MaxKeyLength = 255; + constexpr unsigned int MAX_APE_ITEM_COUNT = 50000; const String FRONT_COVER("COVER ART (FRONT)"); const String BACK_COVER("COVER ART (BACK)"); @@ -471,6 +472,11 @@ void APE::Tag::parse(const ByteVector &data) for(unsigned int i = 0; i < d->footer.itemCount() && pos <= data.size() - 11; i++) { + if(i >= MAX_APE_ITEM_COUNT) { + debug("APE::Tag::parse() - Maximum item count exceeded. Stopped parsing."); + return; + } + const int nullPos = data.find('\0', pos + 8); if(nullPos < 0) { debug("APE::Tag::parse() - Couldn't find a key/value separator. Stopped parsing.");