mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-08-14 06:17:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

MPC: validate SV8 packet size (#1391)

Browse Source 
SV8 packet parsing subtracted its header size from an unchecked
unsigned packet length. An undersized value could wrap and make the
parser allocate the remainder of a large file.

Reject packet lengths smaller than their header or beyond the remaining
file data before reading the payload.
This commit is contained in:
Acts1631
2026-08-03 15:46:46 +02:00
committed by GitHub
parent fd97c86bcb
commit cb92e0aec4
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglib/mpc/mpcproperties.cpp
+14 -1
View File
@@ -27,6 +27,7 @@
#include <array>
#include <cmath>
#include <limits>
#include "tdebug.h"
#include "tstring.h"
@@ -186,7 +187,19 @@ void MPC::Properties::readSV8(File *file, offset_t streamLength)
break;
}
const unsigned long dataSize = packetSize - 2 - packetSizeLength;
const unsigned long headerSize = 2 + packetSizeLength;
const offset_t offset = file->tell();
if(packetSize < headerSize || offset < 0 || offset > streamLength) {
debug("MPC::Properties::readSV8() - Invalid packet size.");
break;
}
const unsigned long dataSize = packetSize - headerSize;
const auto remaining = static_cast<unsigned long long>(streamLength - offset);
if(dataSize > remaining || dataSize > std::numeric_limits<unsigned int>::max()) {
debug("MPC::Properties::readSV8() - Packet size exceeds remaining data.");
break;
}
const ByteVector data = file->readBlock(dataSize);
if(data.size() != dataSize) {