From 94f7b5af4c6ee6b1a5a81bd04ae1bf04132b352b Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:36:58 -0400
Subject: [PATCH] XM: assume 40 bytes for zero sample header size (#1422)

A zero sample header size makes the sample loop consume no input,
allowing crafted instrument and sample counts to cause excessive CPU
and memory use during parsing.

Some trackers write zero sample header sizes, some trackers ignore
such values and assume a standard header size of 40 bytes. We do the
same to ensure the sample loop advances.
---
 taglib/xm/xmfile.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/taglib/xm/xmfile.cpp b/taglib/xm/xmfile.cpp
index 6a3396d6..1b33873c 100644
--- a/taglib/xm/xmfile.cpp
+++ b/taglib/xm/xmfile.cpp
@@ -594,6 +594,10 @@ void XM::File::read(bool)
       sumSampleCount += sampleCount;
       // wouldn't know which header size to assume otherwise:
       READ_ASSERT(instrumentHeaderSize >= inCnt + 4 && readU32L(sampleHeaderSize));
+      // Some trackers wrote zero here even though 40-byte sample headers
+      // follow. The value is ignored by FastTracker 2 and other loaders.
+      if(sampleHeaderSize == 0)
+        sampleHeaderSize = 40;
       // skip unhandled header proportion:
       seek(instrumentHeaderSize - inCnt - 4, Current);