mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-05-27 21:20:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash with invalid WAV files (#1163) (#1164)

Browse Source 
With specially crafted WAV files having the "id3 " chunk as the
only valid chunk, when trying to write the tags, the existing
"id3 " chunk is removed, and then vector::front() is called on
the now empty chunks vector.
Now it is checked if the vector is empty to avoid the crash.
This commit is contained in:
Urs Fleisch 2023-11-05 14:40:18 +01:00 committed by GitHub
parent f202fa25c3
commit dfa33bec08
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
taglib/riff/rifffile.cpp
View File

@ -361,6 +361,9 @@ void RIFF::File::writeChunk(const ByteVector &name, const ByteVector &data,
void RIFF::File::updateGlobalSize()
{
if(d->chunks.empty())
return;
const Chunk first = d->chunks.front();
const Chunk last = d->chunks.back();
d->size = static_cast<unsigned int>(last.offset + last.size + last.padding - first.offset + 12);

BIN
tests/data/invalid-chunk.wav Normal file
View File

Binary file not shown.

18
tests/test_wav.cpp
View File

@ -59,6 +59,7 @@ class TestWAV : public CppUnit::TestFixture
CPPUNIT_TEST(testStripAndProperties);
CPPUNIT_TEST(testPCMWithFactChunk);
CPPUNIT_TEST(testWaveFormatExtensible);
CPPUNIT_TEST(testInvalidChunk);
CPPUNIT_TEST_SUITE_END();
public:
@ -385,6 +386,23 @@ public:
CPPUNIT_ASSERT_EQUAL(1, f.audioProperties()->format());
}
void testInvalidChunk()
{
ScopedFileCopy copy("invalid-chunk", ".wav");
{
RIFF::WAV::File f(copy.fileName().c_str());
CPPUNIT_ASSERT_EQUAL(0, f.audioProperties()->lengthInSeconds());
CPPUNIT_ASSERT(f.hasID3v2Tag());
f.ID3v2Tag()->setTitle("Title");
f.save();
}
{
RIFF::WAV::File f(copy.fileName().c_str());
CPPUNIT_ASSERT(!f.hasID3v2Tag());
}
}
};
CPPUNIT_TEST_SUITE_REGISTRATION(TestWAV);