From a1d0488dc62809785654356376e6eca9c51d6439 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:35:36 -0400
Subject: [PATCH] RIFF: limit parsed chunk count (#1394)

RIFF files could contain an unbounded number of small chunks. The
parser retained a descriptor for each chunk, allowing a crafted file
to consume disproportionate memory.

Reject files that exceed a maximum parsed chunk count.
---
 taglib/riff/rifffile.cpp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/taglib/riff/rifffile.cpp b/taglib/riff/rifffile.cpp
index 2594c1a3..d4a7ca59 100644
--- a/taglib/riff/rifffile.cpp
+++ b/taglib/riff/rifffile.cpp
@@ -33,6 +33,12 @@
 
 using namespace TagLib;
 
+namespace {
+
+  constexpr int MAX_RIFF_CHUNK_COUNT = 50000;
+
+}
+
 struct Chunk
 {
   ByteVector   name;
@@ -296,6 +302,12 @@ void RIFF::File::read()
   // + 8: chunk header at least, fix for additional junk bytes
   while(offset + 8 <= length()) {
 
+    if(d->chunks.size() >= MAX_RIFF_CHUNK_COUNT) {
+      debug("RIFF::File::read() -- Maximum chunk count exceeded");
+      setValid(false);
+      return;
+    }
+
     seek(offset);
     const ByteVector   chnkName = readBlock(4);
     unsigned int chunkSize = readBlock(4).toUInt(bigEndian);