diff --git a/taglib/riff/aiff/aifffile.cpp b/taglib/riff/aiff/aifffile.cpp index 425bfa02..72667f6e 100644 --- a/taglib/riff/aiff/aifffile.cpp +++ b/taglib/riff/aiff/aifffile.cpp @@ -87,6 +87,11 @@ bool RIFF::AIFF::File::save() return false; } + if(!isValid()) { + debug("RIFF::AIFF::File::save() -- Trying to save invalid file."); + return false; + } + setChunkData(d->tagChunkID, d->tag->render()); return true; diff --git a/taglib/riff/rifffile.cpp b/taglib/riff/rifffile.cpp index 8d23bcd6..a3ca0e3e 100644 --- a/taglib/riff/rifffile.cpp +++ b/taglib/riff/rifffile.cpp @@ -194,6 +194,19 @@ void RIFF::File::setChunkData(const ByteVector &name, const ByteVector &data) // private members //////////////////////////////////////////////////////////////////////////////// +static bool isValidChunkID(const ByteVector &name) +{ + if(name.size() != 4) { + return false; + } + for(int i = 0; i < 4; i++) { + if(name[i] < 32 || name[i] > 127) { + return false; + } + } + return true; +} + void RIFF::File::read() { bool bigEndian = (d->endianness == BigEndian); @@ -207,8 +220,15 @@ void RIFF::File::read() ByteVector chunkName = readBlock(4); uint chunkSize = readBlock(4).toUInt(bigEndian); + if(!isValidChunkID(chunkName)) { + debug("RIFF::File::read() -- Chunk '" + chunkName + "' has invalid ID"); + setValid(false); + break; + } + if(tell() + chunkSize > uint(length())) { - // something wrong + debug("RIFF::File::read() -- Chunk '" + chunkName + "' has invalid size (larger than the file size)"); + setValid(false); break; } diff --git a/taglib/riff/wav/wavfile.cpp b/taglib/riff/wav/wavfile.cpp index 9ec3b510..37d8a4d2 100644 --- a/taglib/riff/wav/wavfile.cpp +++ b/taglib/riff/wav/wavfile.cpp @@ -87,6 +87,11 @@ bool RIFF::WAV::File::save() return false; } + if(!isValid()) { + debug("RIFF::WAV::File::save() -- Trying to save invalid file."); + return false; + } + setChunkData(d->tagChunkID, d->tag->render()); return true; diff --git a/tests/data/zero-size-chunk.wav b/tests/data/zero-size-chunk.wav new file mode 100644 index 00000000..8517e797 Binary files /dev/null and b/tests/data/zero-size-chunk.wav differ diff --git a/tests/test_wav.cpp b/tests/test_wav.cpp index 38a9a0fb..0bd82018 100644 --- a/tests/test_wav.cpp +++ b/tests/test_wav.cpp @@ -13,6 +13,7 @@ class TestWAV : public CppUnit::TestFixture { CPPUNIT_TEST_SUITE(TestWAV); CPPUNIT_TEST(testLength); + CPPUNIT_TEST(testZeroSizeDataChunk); CPPUNIT_TEST_SUITE_END(); public: @@ -20,9 +21,16 @@ public: void testLength() { RIFF::WAV::File f("data/empty.wav"); + CPPUNIT_ASSERT_EQUAL(true, f.isValid()); CPPUNIT_ASSERT_EQUAL(3, f.audioProperties()->length()); } + void testZeroSizeDataChunk() + { + RIFF::WAV::File f("data/zero-size-chunk.wav"); + CPPUNIT_ASSERT_EQUAL(false, f.isValid()); + } + }; CPPUNIT_TEST_SUITE_REGISTRATION(TestWAV);