mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-06-04 01:28:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #473 from TsudaKageyu/fix-infotag

Browse Source 
Fix an infinite loop when parsing an INFO tag.
This commit is contained in:
Lukáš Lalinský 2015-01-01 19:46:53 +01:00
commit bd7b8cc36a
5 changed files with 28 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
taglib/riff/wav/infotag.cpp
View File

@ -258,9 +258,15 @@ void RIFF::Info::Tag::parse(const ByteVector &data)
uint p = 4;
while(p < data.size()) {
const uint size = data.toUInt(p + 4, false);
d->fieldListMap[data.mid(p, 4)] = TagPrivate::stringHandler->parse(data.mid(p + 8, size));
if(size > data.size() - p - 8)
break;
const ByteVector id = data.mid(p, 4);
if(isValidChunkID(id)) {
const String text = TagPrivate::stringHandler->parse(data.mid(p + 8, size));
d->fieldListMap[id] = text;
}
p += ((size + 1) & ~1) + 8;
}
}

5
taglib/riff/wav/wavproperties.cpp
View File

@ -115,6 +115,11 @@ TagLib::uint RIFF::WAV::Properties::sampleFrames() const
void RIFF::WAV::Properties::read(const ByteVector &data)
{
if(data.size() < 16) {
debug("RIFF::WAV::Properties::read() - \"fmt \" chunk is too short for WAV.");
return;
}
d->format = data.toShort(0, false);
d->channels = data.toShort(2, false);
d->sampleRate = data.toUInt(4, false);

BIN
tests/data/infloop.wav Normal file
View File

Binary file not shown.

BIN
tests/data/segfault.wav Normal file
View File

Binary file not shown.

16
tests/test_wav.cpp
View File

@ -15,6 +15,8 @@ class TestWAV : public CppUnit::TestFixture
CPPUNIT_TEST(testLength);
CPPUNIT_TEST(testZeroSizeDataChunk);
CPPUNIT_TEST(testStripTags);
CPPUNIT_TEST(testFuzzedFile1);
CPPUNIT_TEST(testFuzzedFile2);
CPPUNIT_TEST_SUITE_END();
public:
@ -67,7 +69,19 @@ public:
CPPUNIT_ASSERT(!f->hasID3v2Tag());
CPPUNIT_ASSERT(f->hasInfoTag());
delete f;
}
}
void testFuzzedFile1()
{
RIFF::WAV::File f1(TEST_FILE_PATH_C("infloop.wav"));
CPPUNIT_ASSERT(!f1.isValid());
}
void testFuzzedFile2()
{
RIFF::WAV::File f2(TEST_FILE_PATH_C("segfault.wav"));
CPPUNIT_ASSERT(f2.isValid());
}
};