From c0f2a939b446809f0a05fc2fbaf492cbdd24dba5 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:46:53 -0400
Subject: [PATCH] MP4: limit atoms in nested containers (#1392)

Nested MP4 containers did not enforce the atom count limit applied at
the root level. A small file with many child atoms could consume
disproportionate memory while building the atom tree.

Apply the per-level limit to container children and reject files that
exceed it.
---
 taglib/mp4/mp4atom.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/taglib/mp4/mp4atom.cpp b/taglib/mp4/mp4atom.cpp
index 1320277e..d0b2f379 100644
--- a/taglib/mp4/mp4atom.cpp
+++ b/taglib/mp4/mp4atom.cpp
@@ -40,6 +40,7 @@ namespace {
     "stbl", "minf", "moof", "traf", "trak",
     "stsd", "stem"
   };
+  constexpr int MAX_MP4_ATOM_COUNT_PER_LEVEL = 50000;
 } // namespace
 
 class MP4::Atom::AtomPrivate
@@ -116,6 +117,13 @@ MP4::Atom::Atom(File *file, int depth)
         return;
       }
       while(file->tell() < d->offset + d->length) {
+        if(d->children.size() >= MAX_MP4_ATOM_COUNT_PER_LEVEL) {
+          debug("MP4: Maximum atom count exceeded");
+          d->children.clear();
+          d->length = 0;
+          file->seek(0, File::End);
+          return;
+        }
         auto child = new MP4::Atom(file, depth + 1);
         d->children.append(child);
         if(child->d->length == 0)
@@ -223,8 +231,6 @@ public:
 MP4::Atoms::Atoms(File *file) :
   d(std::make_unique<AtomsPrivate>())
 {
-  static constexpr int MAX_MP4_ATOM_COUNT_PER_LEVEL = 50000;
-
   d->atoms.setAutoDelete(true);
 
   file->seek(0, File::End);