From 766471a5a4794370b3cc45f0113ec18f8715a13d Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:07:47 -0400
Subject: [PATCH] APE: limit parsed tag item count (#1411)

An APEv2 footer controls the number of parsed items without a bound.
A small crafted tag can therefore allocate a large item map and terminate
a memory-constrained application.

Stop parsing after 50,000 items. This matches existing parser count limits
and preserves entries parsed before the limit.
---
 taglib/ape/apetag.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/taglib/ape/apetag.cpp b/taglib/ape/apetag.cpp
index 9c359aad..f5b43f26 100644
--- a/taglib/ape/apetag.cpp
+++ b/taglib/ape/apetag.cpp
@@ -49,6 +49,7 @@ namespace
 {
   constexpr unsigned int MinKeyLength = 2;
   constexpr unsigned int MaxKeyLength = 255;
+  constexpr unsigned int MAX_APE_ITEM_COUNT = 50000;
 
   const String FRONT_COVER("COVER ART (FRONT)");
   const String BACK_COVER("COVER ART (BACK)");
@@ -471,6 +472,11 @@ void APE::Tag::parse(const ByteVector &data)
 
   for(unsigned int i = 0; i < d->footer.itemCount() && pos <= data.size() - 11; i++) {
 
+    if(i >= MAX_APE_ITEM_COUNT) {
+      debug("APE::Tag::parse() - Maximum item count exceeded. Stopped parsing.");
+      return;
+    }
+
     const int nullPos = data.find('\0', pos + 8);
     if(nullPos < 0) {
       debug("APE::Tag::parse() - Couldn't find a key/value separator. Stopped parsing.");