RIFF: limit parsed chunk count (#1394)

RIFF files could contain an unbounded number of small chunks. The
parser retained a descriptor for each chunk, allowing a crafted file
to consume disproportionate memory.

Reject files that exceed a maximum parsed chunk count.

taglib/riff/rifffile.cpp

@@ -33,6 +33,12 @@
 
 using namespace TagLib;
 
+namespace {
+
+  constexpr int MAX_RIFF_CHUNK_COUNT = 50000;
+
+}
+
 struct Chunk
 {
   ByteVector   name;
@@ -296,6 +302,12 @@ void RIFF::File::read()
   // + 8: chunk header at least, fix for additional junk bytes
   while(offset + 8 <= length()) {
 
+    if(d->chunks.size() >= MAX_RIFF_CHUNK_COUNT) {
+      debug("RIFF::File::read() -- Maximum chunk count exceeded");
+      setValid(false);
+      return;
+    }
+
     seek(offset);
     const ByteVector   chnkName = readBlock(4);
     unsigned int chunkSize = readBlock(4).toUInt(bigEndian);