From c767a557448c473baee01da4f37e6a9958a2b027 Mon Sep 17 00:00:00 2001
From: manuaudio <manu@arimaka.com>
Date: Sat, 15 Aug 2026 00:34:17 -0700
Subject: [PATCH] AIFF: do not convert out of range properties to int

Fourth instance of the same shape. The sample rate is an 80 bit float
read from the file and the frame count is a 32 bit count from it, so all
three conversions here can be handed a value int cannot represent:

  taglib/riff/aiff/aiffproperties.cpp:145:38: runtime error: 6.29416e+49
  is outside the range of representable values of type 'int'
  taglib/riff/aiff/aiffproperties.cpp:150:35: runtime error: 1.00707e+48
  is outside the range of representable values of type 'int'

Line 149 is the same shape and reachable the other way round, with a
large sampleFrames over a small sample rate, so it is guarded too.

Leave the field at its default rather than converting. All seven AIFF
files in tests/data report identical channels, sample rate, bitrate and
length before and after.

Two reports before the change, none after.

Assisted-By: Claude Code (Claude Opus 5)
---
 taglib/riff/aiff/aiffproperties.cpp | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/taglib/riff/aiff/aiffproperties.cpp b/taglib/riff/aiff/aiffproperties.cpp
index 4b609f7e..d1cc4075 100644
--- a/taglib/riff/aiff/aiffproperties.cpp
+++ b/taglib/riff/aiff/aiffproperties.cpp
@@ -25,6 +25,8 @@
 
 #include "aiffproperties.h"
 
+#include <limits>
+
 #include "tdebug.h"
 #include "aifffile.h"
 
@@ -140,14 +142,23 @@ void RIFF::AIFF::Properties::read(File *file)
   d->sampleFrames  = data.toUInt(2U);
   d->bitsPerSample = data.toShort(6U);
 
+  // The sample rate is an 80 bit float read from the file and the frame count is a
+  // 32 bit count from it, so all three of these can be handed a value int cannot
+  // represent, and converting a double the destination type cannot represent is
+  // undefined. Leave the field at its default rather than converting.
   const long double smplRate = data.toFloat80BE(8);
-  if(smplRate >= 1.0)
+  if(smplRate >= 1.0 && smplRate < static_cast<long double>(std::numeric_limits<int>::max()))
     d->sampleRate = static_cast<int>(smplRate + 0.5);
 
   if(d->sampleFrames > 0 && d->sampleRate > 0) {
     const auto length = static_cast<double>(d->sampleFrames) * 1000.0 / smplRate;
-    d->length  = static_cast<int>(length + 0.5);
-    d->bitrate = static_cast<int>(streamLength * 8.0 / length + 0.5);
+    if(length > 0.0 && length < static_cast<double>(std::numeric_limits<int>::max())) {
+      d->length = static_cast<int>(length + 0.5);
+
+      const double bitrate = streamLength * 8.0 / static_cast<double>(length);
+      if(bitrate >= 0.0 && bitrate < static_cast<double>(std::numeric_limits<int>::max()))
+        d->bitrate = static_cast<int>(bitrate + 0.5);
+    }
   }
 
   if(data.size() >= 23) {