From cb92e0aec4e3ced74010fe536f9c76356d3949fe Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:46:46 -0400
Subject: [PATCH] MPC: validate SV8 packet size (#1391)

SV8 packet parsing subtracted its header size from an unchecked
unsigned packet length. An undersized value could wrap and make the
parser allocate the remainder of a large file.

Reject packet lengths smaller than their header or beyond the remaining
file data before reading the payload.
---
 taglib/mpc/mpcproperties.cpp | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/taglib/mpc/mpcproperties.cpp b/taglib/mpc/mpcproperties.cpp
index 6da886c1..ba5c47e5 100644
--- a/taglib/mpc/mpcproperties.cpp
+++ b/taglib/mpc/mpcproperties.cpp
@@ -27,6 +27,7 @@
 
 #include <array>
 #include <cmath>
+#include <limits>
 
 #include "tdebug.h"
 #include "tstring.h"
@@ -186,7 +187,19 @@ void MPC::Properties::readSV8(File *file, offset_t streamLength)
       break;
     }
 
-    const unsigned long dataSize = packetSize - 2 - packetSizeLength;
+    const unsigned long headerSize = 2 + packetSizeLength;
+    const offset_t offset = file->tell();
+    if(packetSize < headerSize || offset < 0 || offset > streamLength) {
+      debug("MPC::Properties::readSV8() - Invalid packet size.");
+      break;
+    }
+
+    const unsigned long dataSize = packetSize - headerSize;
+    const auto remaining = static_cast<unsigned long long>(streamLength - offset);
+    if(dataSize > remaining || dataSize > std::numeric_limits<unsigned int>::max()) {
+      debug("MPC::Properties::readSV8() - Packet size exceeds remaining data.");
+      break;
+    }
 
     const ByteVector data = file->readBlock(dataSize);
     if(data.size() != dataSize) {