mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-02-21 23:53:02 -05:00
Code Issues Packages Projects Releases Wiki Activity

wavpack: Fix infinite loop when reading broken files (#1304)

Browse Source 
A crafted file can have blockSamples set to 0 and a blockSize so big
that when adding 8 it overflows and offset is 0 so it goes back to the
same position and loops forever
This commit is contained in:
tsdgeos
2026-02-04 17:31:59 +01:00
committed by GitHub
parent cf86f20b36
commit f4117f873c
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
taglib/wavpack/wavpackproperties.cpp
View File

@ -260,16 +260,16 @@ void WavPack::Properties::read(File *file, offset_t streamLength)
const unsigned int flags = data.toUInt(24, false);
unsigned int smplRate = sampleRates[(flags & SRATE_MASK) >> SRATE_LSB];
if(!blockSamples) { // ignore blocks with no samples
offset += blockSize + 8;
continue;
}
if(blockSize < 24 || blockSize > 1048576) {
debug("WavPack::Properties::read() -- Invalid block header found.");
break;
}
if(!blockSamples) { // ignore blocks with no samples
offset += blockSize + 8;
continue;
}
// For non-standard sample rates or DSD audio files, we must read and parse the block
// to actually determine the sample rate.