From eb4ba7e93be6bb2ef3291efd4b006a03d9570808 Mon Sep 17 00:00:00 2001
From: Acts1631 <69813585+acts-1631@users.noreply.github.com>
Date: Tue, 4 Aug 2026 00:10:22 -0400
Subject: [PATCH] FLAC: limit metadata block count (#1396)

FLAC metadata scanning retained an unbounded number of blocks. A
crafted file with many small blocks could consume disproportionate
memory.

Reject files that exceed a maximum metadata block count.
---
 taglib/flac/flacfile.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/taglib/flac/flacfile.cpp b/taglib/flac/flacfile.cpp
index 91bb5897..cf6df9ba 100644
--- a/taglib/flac/flacfile.cpp
+++ b/taglib/flac/flacfile.cpp
@@ -49,6 +49,7 @@ namespace
   constexpr long MaxPaddingLegnth = 1024 * 1024;
 
   constexpr char LastBlockFlag = '\x80';
+  constexpr unsigned int MAX_FLAC_METADATA_BLOCK_COUNT = 50000;
 }  // namespace
 
 class FLAC::File::FilePrivate
@@ -627,8 +628,15 @@ void FLAC::File::scan()
   nextBlockOffset += 4;
   d->flacStart = nextBlockOffset;
 
+  unsigned int blockCount = 0;
   while(true) {
 
+    if(blockCount++ >= MAX_FLAC_METADATA_BLOCK_COUNT) {
+      debug("FLAC::File::scan() -- Maximum metadata block count exceeded");
+      setValid(false);
+      return;
+    }
+
     seek(nextBlockOffset);
     const ByteVector header = readBlock(4);
     if(header.size() != 4) {