From 7f2964ab8bafb5716b63cecd9f5a9a8fe059752a Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Tue, 18 Aug 2026 00:59:51 -0400
Subject: [PATCH] MPC: guard SV7 property conversions (#1423)

SV7 derives the audio length and bitrate from file-controlled frame
counts and stream length. A crafted stream can make the derived bitrate
exceed the int property range, so converting it is undefined.
Guard the SV7 conversions, and account for rounding when checking the
existing SV8 conversions.
---
 taglib/mpc/mpcproperties.cpp | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/taglib/mpc/mpcproperties.cpp b/taglib/mpc/mpcproperties.cpp
index 144473ed..5f013760 100644
--- a/taglib/mpc/mpcproperties.cpp
+++ b/taglib/mpc/mpcproperties.cpp
@@ -245,11 +245,13 @@ void MPC::Properties::readSV8(File *file, offset_t streamLength)
         // undefined. Leave the fields at their defaults rather than converting.
         const auto length = static_cast<double>(frameCount) * 1000.0 / d->sampleRate;
 
-        if(length > 0.0 && length < static_cast<double>(std::numeric_limits<int>::max())) {
+        if(length > 0.0 &&
+           length + 0.5 <= static_cast<double>(std::numeric_limits<int>::max())) {
           d->length = static_cast<int>(length + 0.5);
 
           const double bitrate = static_cast<double>(streamLength) * 8.0 / length;
-          if(bitrate >= 0.0 && bitrate < static_cast<double>(std::numeric_limits<int>::max()))
+          if(bitrate >= 0.0 &&
+             bitrate + 0.5 <= static_cast<double>(std::numeric_limits<int>::max()))
             d->bitrate = static_cast<int>(bitrate + 0.5);
         }
       }
@@ -350,9 +352,14 @@ void MPC::Properties::readSV7(const ByteVector &data, offset_t streamLength)
 
   if(d->sampleFrames > 0 && d->sampleRate > 0) {
     const auto length = static_cast<double>(d->sampleFrames) * 1000.0 / d->sampleRate;
-    d->length = static_cast<int>(length + 0.5);
+    if(length + 0.5 <= static_cast<double>(std::numeric_limits<int>::max())) {
+      d->length = static_cast<int>(length + 0.5);
 
-    if(d->bitrate == 0)
-      d->bitrate = static_cast<int>(static_cast<double>(streamLength) * 8.0 / length + 0.5);
+      if(d->bitrate == 0) {
+        const double bitrate = static_cast<double>(streamLength) * 8.0 / length;
+        if(bitrate + 0.5 <= static_cast<double>(std::numeric_limits<int>::max()))
+          d->bitrate = static_cast<int>(bitrate + 0.5);
+      }
+    }
   }
 }