From f7c28ac742b7fee9232c7f03b53c84a387f62869 Mon Sep 17 00:00:00 2001
From: Urs Fleisch <ufleisch@users.sourceforge.net>
Date: Fri, 17 Jul 2026 05:22:50 +0200
Subject: [PATCH] MP4: Fix QT chapters excessive sample allocation with invalid
 stsc (#1379)

See https://mail.kde.org/pipermail/taglib-devel/2026-July/003122.html

---------

Co-authored-by: Lee, Brian J <hibrian827@gatech.edu>
---
 taglib/mp4/mp4qtchapterlist.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/taglib/mp4/mp4qtchapterlist.cpp b/taglib/mp4/mp4qtchapterlist.cpp
index 93d2abd3..3b2b6989 100644
--- a/taglib/mp4/mp4qtchapterlist.cpp
+++ b/taglib/mp4/mp4qtchapterlist.cpp
@@ -825,6 +825,9 @@ namespace
     const std::vector<unsigned int> chunkOffsets = readStco(file, chapterTrak);
     if(chunkOffsets.empty())
       return {};
+    // Sample count cannot be > file length / 4 as every sample consumes 4 bytes in stsz
+    if(sizeInfo.sampleCount == 0 || sizeInfo.sampleCount > file->length() / 4)
+      return {};
 
     // Read stsc entries
     struct StscEntry {
@@ -875,6 +878,9 @@ namespace
       }
 
       unsigned int offsetInChunk = 0;
+      if(samplesInChunk > sizeInfo.sampleCount - sampleIndex)
+        samplesInChunk = sizeInfo.sampleCount - sampleIndex;
+
       for(unsigned int s = 0; s < samplesInChunk; ++s) {
         sampleOffsets.push_back(chunkOffsets[chunkIdx] + offsetInChunk);