mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-05-27 21:20:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

MP4: Detect atoms with invalid length or type (#1077)

Browse Source
This commit is contained in:
Urs Fleisch 2023-03-18 08:07:46 +01:00 committed by GitHub
parent a31356e330
commit e21640bf10
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
taglib/mp4/mp4atom.cpp
View File

@ -73,7 +73,7 @@ MP4::Atom::Atom(File *file)
}
}
if(length < 8) {
if(length < 8 || length > file->length() - offset) {
debug("MP4: Invalid atom size");
length = 0;
file->seek(0, File::End);
@ -81,6 +81,14 @@ MP4::Atom::Atom(File *file)
}
name = header.mid(4, 4);
for(int i = 0; i < 4; ++i) {
const char ch = name.at(i);
if((ch < ' ' || ch > '~') && ch != '\251') {
debug("MP4: Invalid atom type");
length = 0;
file->seek(0, File::End);
}
}
for(int i = 0; i < numContainers; i++) {
if(name == containers[i]) {

BIN
tests/data/ilst-is-last.m4a
View File

Binary file not shown.

5
tests/test_mp4.cpp
View File

@ -575,7 +575,10 @@ public:
void testFuzzedFile()
{
MP4::File f(TEST_FILE_PATH_C("infloop.m4a"));
CPPUNIT_ASSERT(f.isValid());
// The file has an invalid atom length of 2775 in the last atom
// ("free", offset 0xc521, 00000ad7 66726565), whereas the remaining file
// length is 2727 bytes, therefore the file is now considered invalid.
CPPUNIT_ASSERT(!f.isValid());
}
void testRepeatedSave()