From fa189f6cf73ad67656182149ab32395f66a255b3 Mon Sep 17 00:00:00 2001
From: Urs Fleisch <ufleisch@users.sourceforge.net>
Date: Fri, 26 Jun 2026 09:39:27 +0200
Subject: [PATCH] Fix data length indicator check for compressed ID3v2 frames
 (#1371)

---
 taglib/mpeg/id3v2/id3v2frame.cpp            |   6 ++++--
 taglib/toolkit/tzlib.cpp                    |  15 ++++++++++++++-
 taglib/toolkit/tzlib.h                      |   5 +++++
 tests/data/compressed_id3_frame.mp3         | Bin 5000 -> 4088 bytes
 tests/data/compressed_id3_frame_invalid.mp3 | Bin 0 -> 5000 bytes
 tests/test_id3v2.cpp                        |   4 ++--
 6 files changed, 25 insertions(+), 5 deletions(-)
 create mode 100644 tests/data/compressed_id3_frame_invalid.mp3

diff --git a/taglib/mpeg/id3v2/id3v2frame.cpp b/taglib/mpeg/id3v2/id3v2frame.cpp
index ae69ac1b..a496302f 100644
--- a/taglib/mpeg/id3v2/id3v2frame.cpp
+++ b/taglib/mpeg/id3v2/id3v2frame.cpp
@@ -295,7 +295,8 @@ ByteVector Frame::fieldData(const ByteVector &frameData) const
     frameDataLength = SynchData::toUInt(frameData.mid(headerSize, 4));
     frameDataOffset += 4;
   }
-  if(frameData.size() >= headerSize &&
+  if(!d->header->compression() &&
+     frameData.size() >= headerSize &&
      frameDataOffset + frameDataLength > frameData.size()) {
     // The first check is needed because some "dual purpose" frame constructors
     // call this method with only the frame ID, i.e. without a complete header.
@@ -309,7 +310,8 @@ ByteVector Frame::fieldData(const ByteVector &frameData) const
       return ByteVector();
     }
 
-    const ByteVector outData = zlib::decompress(frameData.mid(frameDataOffset));
+    const ByteVector outData = zlib::decompress(frameData.mid(frameDataOffset),
+                                                frameDataLength);
     if(!outData.isEmpty() && frameDataLength != outData.size()) {
       debug("frameDataLength does not match the data length returned by zlib");
     }
diff --git a/taglib/toolkit/tzlib.cpp b/taglib/toolkit/tzlib.cpp
index 2e055b8b..5172c916 100644
--- a/taglib/toolkit/tzlib.cpp
+++ b/taglib/toolkit/tzlib.cpp
@@ -24,6 +24,7 @@
  ***************************************************************************/
 
 #include "tzlib.h"
+#include <climits>
 
 #ifdef HAVE_CONFIG_H
 # include "config.h"
@@ -50,7 +51,8 @@ bool zlib::isAvailable()
 #endif
 }
 
-ByteVector zlib::decompress([[maybe_unused]] const ByteVector &data)
+ByteVector zlib::decompress([[maybe_unused]] const ByteVector &data,
+                            unsigned int maxLength)
 {
 #ifdef HAVE_ZLIB
 
@@ -90,6 +92,12 @@ ByteVector zlib::decompress([[maybe_unused]] const ByteVector &data)
     }
 
     outData.resize(outData.size() - stream.avail_out);
+
+    if(outData.size() > maxLength && maxLength != UINT_MAX) {
+      debug("zlib::decompress() - Too long compressed stream.");
+      outData.resize(maxLength);
+      break;
+    }
   } while(stream.avail_out == 0);
 
   inflateEnd(&stream);
@@ -102,3 +110,8 @@ ByteVector zlib::decompress([[maybe_unused]] const ByteVector &data)
 
 #endif
 }
+
+ByteVector zlib::decompress([[maybe_unused]] const ByteVector &data)
+{
+  return decompress(data, UINT_MAX);
+}
diff --git a/taglib/toolkit/tzlib.h b/taglib/toolkit/tzlib.h
index 38df4c73..7601c625 100644
--- a/taglib/toolkit/tzlib.h
+++ b/taglib/toolkit/tzlib.h
@@ -46,6 +46,11 @@ namespace TagLib {
       */
      ByteVector decompress(const ByteVector &data);
 
+     /*!
+      * Decompress \a data by zlib, at most \a maxLength bytes.
+      */
+     ByteVector decompress(const ByteVector &data, unsigned int maxLength);
+
   }  // namespace zlib
 }  // namespace TagLib
 
diff --git a/tests/data/compressed_id3_frame.mp3 b/tests/data/compressed_id3_frame.mp3
index 824d036fa4459e57ad671a8c3bb910e384b94ff2..15a7c6f47c68ecf2707417ffd7f859d7a80ec4d4 100644
GIT binary patch
literal 4088
zcmY*cc{r49+t*{?g;16uYekf@k6olfQTAoVnr(_93^Rso@uad-GpU$l8I!W4LH4D=
zW1X>$ElUO?+;+bCzVG?teXrv<kK?+}<GTJi@85F$ZknpIFfo>5u#wG86DB4p6cZ;C
ztE_m$*y@`DXCeD@9m^;Js`<FuAgF$_W3B4z$cWkZp^72yk9w6Bckfo-G81NTW;y-s
zZEEZUOI^xD%XJQxI(aVRT9%Ij$u4r|q%R1U^&h>8mzBR_Dp;M-b)cW2xB2t6cHZm0
zNSL~BuU5nxy@lls#hMJ9q=ZDZj@fEVAH;F0V=;YqemWzy55b4(hn@I)pZM49`GTBi
zp^iQ${tr_`5YEY90<Kyb_#%LC3PkP=8zvJUIW&|CAkeXLKsf0YdHjL}6xJxc`VuVj
zg=?3J1<Rb~L-<3{l{nzDIWTmu74wvwA%GBsS{u`-m!U)+9v+8#@i*R6J|vRUx;xt2
zl@EIgMsrW>f#v1p$;nBbH@&aU_2(C~BGoT;VDDed($>~~fIoZYnd$j2I8tRzC1>Ds
zaE1smF!A@e-ofxVwYoRRNOobVsJxuCgjZHp_7LTITWNa!3iW51bKO6iNy92iN==ue
z=akCCj?Y^$ht0O89bbM@-S26F^L%GMCW*NA!b;UI;Qfijp^cA`YT)GIpt>vLBD=-|
zLGzhMnOA73%TZT;7d%!*riO`@iHDzto)pWC#@(Lb323=d!4t4^Ju8iveciG;_*XH-
zWO|I3^8R9`k?K>RK;L-;ZLv=6#*D|EX-U-J`D)|C>$wr&=t&+epIF*^AL6rlS7zy)
z6sso_z0BC8sxR&Dh%7O{0^0bQ^;_G8vs+!JVrk)!)!^ghyow1HHp8~d3+uePAl>ed
zAc#-Ax>+Ll{x0pT%*egh2iL{~c3WJSyyGq*leH0>wm{e=&8XvPk|gU2F%cZP=yJ1V
z+ViWbgKNZgdV|WRGkl0I+{fC3cF`s>JkHOulp|Dbct!-y-(DI2UY4RoHT|U!s9!an
z`1%2ETIpdf>$F{+!SlwzYrVc%;^Evfm5aHL5%&0k%MY(b%{sBj{q$`N{-w|h`dJy!
zl2cBeDaOx>JqY%sISy5ojDB>i<o&JeSTpNAc8B<RtD;%rDXDUOr01k?@9lY7jdC3_
zaO<$#d1ieo7Y^z}CXj^?P-|KWn4k!>Vi+I(7k<S5yZyH>1IYa+u5KoSQ+TTs5C839
zdS1DSh>E%sqqcig8^1^Ig+L$>BvOj%&><4o;r1Yn%>5MH!uh31Pg4^&?2juh#u%U~
z9+WC7DsKE87Wf08P#m||wwUXGv&4D#!6ox~E0_*x6!k32?fEXD1mk}gFdZIFSf84j
zLZeR=-P6|4NUTs(SC4OAQd+tU^fN#0!l2pB-dM4pVRwCz-Q^{iVyY}+Z)ca8lQUQU
z?c2ACii*0ry7F?~Bc?V51%>{*{mlIjb9to!jdlz==?Z(#@iDT*&guUBtel*j{QRiR
z1rnJ|&dn8z?r3Y1mzVeU@evUbc?Wtc)cNaAVWEr|r$o>9rdN~Sub6PqjJSWktv4i(
zj*gPa9A8pWQta_=yj)y=c6JO9Kp7s7$6`Sv%*@OtCMI~-dJzx^o0Y|ih?VLe9AsuM
z{Kro~o<porjbh?$#5W}=y}7vwo2Wf4Awip)o12-L`TaX;slPCuoqu+`t*wnjTHW24
z!&zhbI5;@Cx#RD5l1K^eelS=Px1n0HzMS3RUtZ}JyiEcPVQ_e6R@SM-wp3B#_wRfX
zT9r@M-4qpZsPEZtbf2tE5fRje7;+emd<6!BZN+wWTGX;hB=0g2*>@8@9sT9SZ<S0g
z{Av@GyFu??SJlCC9qmR8xi>7hZAt<^8hcR@LjkFqYvsDtFzRz;tW_oI1euFw2%k$s
z^jZCPA3m_`&KyIGk;i+!B8Nf<H*RBizj3m?vvYyiqt!+fIA}j?eTjVy6jK*8UM;B`
zPNP&U(q~!}tzL6*a-KrIw0J7a)Bt+J`9qelSkENLb3LRQK~>BvZiuP_(4#LKV>T$h
z*dG^~SeXo<O_`a(ttYOouAQRO<}Ahgao*HS`yl;@V6^O`LpVF#<lr>Z`Rkp%y}|ze
z=OiRdr&QI3MT<$Ojaf4S>X41BF3NPMc1%CwI1;#cek1<3tfy&zO>M1`2i-V%yBLQX
zlu!*!1GhA;gqr*ME@miNCnhDyu4Gsi$;!$)m5cab$(uSIgUfJnw!Z8a{F8<IYinyp
zMn)EUa)O+Hz_~GSWoX|@fUZTCvR8VWZ)s|2X=!7l!OsQ<<p)Z_9J13k$zVJs-sYQa
zWdhBUY7jZ!1TipZWT3D1aBVI4s}tD3z?v3GlJaR(n1BB3)B4I%qMw0|&bgEZm&@k0
z=CmNDMm_wG5TFo**x%hXH8ab~&JGU`7etJEq<blQj>>aW%!4=dLl=0qkgkA+=7>op
z?Q9zQlX-TjJ`}ur@cHvq@*xAa*J(L!+~WMTA4Ln6*o}Sqnuc6^Kfj21^hj;?u)Etb
z+<Wu|Sp2W<c9b!B*ZMep@3a=8ePOMTBlTy)adz;XJG`^eCV&UefW-yW{<31ZTP+0J
zdc2dfmq!s?7Z>-z=H}*RWXQg>h(aKEDJIJVGu+_AYx%xWksGtDQA{W6dt<DK;v>=(
zGjUG_MeaK|FgUoY0fdHz+S=MO*kD-{;^${kbnlLp)n5jEutPF8BGG;L9Xa-hJpwo<
znqUmc1gGi2B|8re4iHgMbnw-y%_l$H!do#br@(uEFVx2Vd2y{ejst{t3kV2scgNmE
z@o(}0)4VNo2C1Gu=gW-V-@1@?ic1JF)%9~}6BwWU1j|^bAwzkkJx7aX@pyyVCHZ1v
zXC)=Q#ZNVS`eb=A>zp_Lm$60LXZhy+2&JR<=ILHn&(aMd|FATGPD#V=Q;`(BkW_CU
zv%05yk*E;O7xzU8ps&RUGaW1}_z2&)$8@X7cUTd~{_N{>g6w<)$4M{g1R`y1h5l-(
zuC8XN-A8?xdDLmdrAqeEjS88}vUJk=@83|^d_3U!rbOR>83~0+0{yh}c=Ctzqxx}O
ziY-cjjI!E})EY=7JEOrZc%__o^drz(bxn=twQEBoBh9-e+mzj4sT<L)Q~op~&6W#d
zpH3Xc*ii0_F}u6-<NGkQ8Az)+t-J+e7CrERD--{`J2)ta6+v*|!KZ&f1qSkTNm1D%
z1renL-xU3BoVHsmE{W7}m%iV*os^V>!{PRPfE3~|`Q#Hw{4$@FyS|);=+LE0mkJpi
zLmqCJOXbHvVRrzvgUKQlEx7|f78j(M87p0OHl6}v=wm^FEWj{=_C(nU=iY5IXsqg`
zOYx^(^!!Q&!gM6@SHV!2H$Zj{d%UM$)Agjp!`;a#>f|`a^uV&{Rb4cO;a%chC#A=C
z4ISJ6sK2dgtYrZh+PUi!s^xd>98}c{c&l4-&b^M?#m>pWfuo8#Ffc%+rayu~AZRjo
z-qFyIFoI{x&8wS;*s-*<6xg{S{H&|%=5gApB2dsQRSh0h3DF+ouYFliz&#A}^E3R|
zSGuT^Ox&haJp^^f**^AowpmnGR(5z8{d6A;2DiHHKGqkrcOkW+Yr-*oot?21U(e{S
z1@6PKUK))yh_g1c53cfrQ5)Xm<gf#@y`X2?3`d*nHW4(?(sF=nCrB3L=W`KJ^yyQx
z(cK$Qe@fL4`CtEu08;$I11&ANpy2t4B>{Mlc`hw)U<Izj@J)u6+ARuLt-qXua8oOm
z1raNizWg&#T|J${C|B3X?ziiGM}vcdjDMo5tGgGjnnZT~`=}>J^{dlrXJ_(lg&y9<
zugyqnLxzsT#DJgNO(%0d18chLhKGfPrL@h;)vS}zoQloUw8ztQx>^()zCBm~af_l(
zS6i?NP|}>;n@B4waE_*+yF`&q=)>2UFUiiW7_=|{oJ<-lC`jevMN2wjvutrvw<m+}
z*>P`LI1oC`MsQC87u-vDsMo~L%lm_rlbx;5A>V#93Hw!Y#B7xOXFf#xot~6_z6njU
zS?XCY5y@RF<<Cn$|B|C5I?Y@Fx0Oeo^m+(3!1l-h>rGM$l6&K1ve*E88k?7gHg4%)
zR=c`8KR^GmNsTYMS@EQzqy(}9+uhTXB50<9Z$B|JGxPM69e^)gDR3|=v1`WMl6w^w
z7uVX_n%n~+V0S}kp~kZmaZ!P(P12yy!4nVn2M^dtH~u6xl@p1?nwlK&qZGcEd3ljX
z``i8f{hdT4Y+-S42%8YW!D_>Apg3_J@FAFQ^(J~Wl~l>>ynU|1$;rv^cr+S)y1usz
zQ)!Z!+jGO89@%>a3KKziSRI$QwzZj=n!40J`Y}4XgXpj={oz~diViSzXmSp)rcu!`
zPEJm6_*T{>dynz>xVYE}D)nTj#MZqY#D6q_xW4N=-k1gULl<B%m>Yq8i_2$Hh>kSK
zxY1DotYHHH06P8AlP3mITOSt<(r*NBxT%9}V~ox~4K@0n{cTlYPD8cmYiIxyb)gsx
zhMiw(q6S7i2D|UWz&={4IZD6z5EEkxQy<J}Bq)D8f8*Nh>}=gpQ;qZU)&^9wKy*bP
z>cvXwu)lL8`XXb*N89*b_i-P8g@)TZrCbSdi)b)`%7GZX)xDM~`5D;Qc>KnyW3g%K
zHobMq1*oaU1_VTE>F9KmFt=!{aWT#2z98Wg#~U5vD^FUHw&c-;ECx&nX}yU}LJaJQ
zntdSLjbONi#!j3UwDB=OS%ksi@JdQmpnRnw@W2Bbt@Wj@?(7K0wf1Y<C{*Zxmq3lG
z{{9iZO}_<&snXP&=L)wN5`rE4Ab3E6g4UyM$_a*rheJiF?JhzGByW_W{@03%U=I(&
z_y3T)<@KO2R)Evo_*rUd(Y<8`ZLDx}<MXwxNFj#1F--pD7y&YNt9nAX6)6cM&r^9C
z;XJVenv8jFZ*Q!YSVCbjfdAKh(#mP(iqJvN&m7d^6G?)me19MdT;d?VnJe#hJBBp9
z$ZeBM9A?QcANIFj>tE-1TEHHWW!aWEp-PF+6+mQ^zen|~b{l?={V+2F@zZM>Ut*1h
zp71pn4|vcD=585D24jd56C=F(1a~ah4od(9zK|_p4%=cYsCT_Z(@e$^P(`BQ<32Y9
zR19gW_Kf`b-*5l_%>?7D5&xAC{x4lJQUE7G@js%$xR-V6v?$|XiApk9r4=Jm53x>-
zxy*OMEZMs=YIoD_DkG7D7-bv+3HSE%hJ?VS?fkrhyrq@wygmJbVbUSqK@TJBY|O4O
x4zV)o4h$M;XLQ?`vE^Zu-u+-NZ=Z+3-d_54Ce~Jr4lkqr|E`KDB-qpYe*pQGLOK8d

literal 5000
zcmeG=c{r5q*MwAJBBCs#2+6*dWf)<oq*o-{48vqMy$BhGPzVvFtkWiyeM_=t-!h@b
zNMlTP9y>G4SiYy;Kfd?+UEkl|U%%(N?&m)DbMABQ`#$H~XL-zx)j8O}M?nLA)%*e*
z+Yu+WNN|`HlD&|_ayV*xqGKVVETVb$gMn`?rDL(8ibUE#*4i(1a}*pC;&PCGDM^-(
zBXc>$beh2ZPBA2(K6f-$`YQz&DbFq__}Jl)P{GZ{36IRwt|I~$Z%)-w-BaCjyE4);
z*3K_YUhcbmY=P3~UEP8DNryUCdi1B-(B?-SG>RB2Om(DZNZ$Cy=u3l)4-p&mfJ;u>
z1;UD9N`nBZ{>}v+EKk{V@Jaf%Qfn^t9{FsLs=cQvJ6bubEpyUQ^OX@=**2vWDW7oZ
zMxRY9@}#8rkzl}yGA57;4A*{QpOl|Z4^+k3Y9Bx_TZU_yoaS1Z+Vo<W{XkeZ66~)G
zY$uS{&Z3DWar%v?=-Xa2viIe=xjFwg_h~ej>14Oh@=Hrg!K;sbySCajl%!d$t*s=|
z_2|!Imw7!b{@^>h<~Ep>m6dl&jtjm2?p2wu{zO3zC!1v$1Y~$!&SZGGFv{JrH5AgP
zJ3J>;zr1ELLqB6PGBcYIa*@qKLPGS~47;<!diW4ZVWC1;OfYayXdc_@^8AX}voS_y
z^06Qv@j&BH>0qGWaDUoYQj|L%UQQh&;84A{-1?i&+4Xdpa1bKnIM*$ac$tIkH-UsD
zG=*!P<P<~RyFTzUs&}l=yTvr%IB8K`el{ZixT%)+<S*c4OprJI?IFxp9+#b82yczs
zlDLM)@w)UW#T#XQGslgtz3e^Qo*A4;BfA$lE^q#Ier@aRk-#EGlsa3;^%qqm?tP}N
zC+8*10jl3!-?H231|v)*ATG#d!EcWiZ>to=eszUEfssC9H|>f$*v>zt)mz;8DPNwT
zFV$+_Ee7Kf-6z{ia&bH5xMHF}9x-quRQZ1%=f<ufmq*pf6}SA9JafWswD0R_PDgp2
zEwJIkRr2&@+sTi*93d&TUA$SJ=FFFzbaTk-Z1)cxy_Ig0Fxc7%DO(|SOwLpPP}7S{
zOR;=~XVVqkMYZ<?$m%ct>Lu70Cp@i8&-3Ow$QmZv*L1E#ABXvGmJ5wIy^eIARC6Vk
zOH3CC@L&1>&*3Fauc$3RLouGkXm%qlz`?>kaw<B$bjg2;SynYwZ{)6_oK$lQFt<8d
zHf`IQi{i)OO@J+-KZ9#_(X#ZqxPP0~ga3Pw$$@JwQTd1V$?9;U>g>k+Pzkc0xiN%7
zHH4kl)ZF;h##84i?ocXDC`T8=$XriSht;zUd3w{*(#FTfrKF^Yx%#3fPMi=EYt<!{
zagE5z$b1$33i&w4`2a)o5l`nWX4_t$9c*Z5;D$)d1b!lsNa^Xv>Z+@&gKyuS-C*wS
z;sfuMm8lAvBH+Qa7u<4b`W%o4`=i-q_&!M%efK&mFRyXJ!o`J_B&xlPw6e0ge*L<W
zlM@P+jE_WH=IX%_aEM{P3#{pT{wnvy4B&Xkxqwmt0168V&MGPOb#|JWnSBgdLA$xR
z85?tszIyo*?dl3{zM`U{AM*8JW>!{hZ7of@R5@Yaq4p9(`g5+ErB0H-%*@;O@Auh1
zxp;f3HzP8V4TYk%#6oa59BXsanL?!+oIAG(3|I8`_n$d)W|@12-PhOmz>$`gmQDe|
zL{tXgQZ5-g!<Ukgks++)c;N8i_0`qY<z;e1I4fPzK?^&Y$nYKcP*YR0FkCS`_Bk4l
z$LC+kiLy1bv_v?1cz75dFjR|!y|&&y<d%Gyw<)DTQ%mcZpdj1y%6JE3ky7h9_~!OJ
zsmQ)+4z*P2KiRG6O)5k+N<bHWRP_uF9@UprP&oX8UH6oM;SxJO&%SZraP(2Npc{&b
z5`KEpo3Z1f5YC7?*=;N;Yj2A6jeGArlh#+Cpj~WN9yVN#nc<${6xH&H6g?L>^R+8Y
zmR}0oeI%3yRhoE;!n<@e7Fhbh@(k%_{cxT$qeTwY)_C_l1|wS7WN%S?r)lSv@>3<J
zPhnfDRo+8>lux&*4dHM&ys6}RfhwmVfN(cjH3RaL45MDPKU-iz%6@%Qd|CkoC@aaz
zFczTB$rZykhTs!{LX)=}^YXaHxmx+}Wi+6Nsa<kq(7HQt$r~%P{$sHlQtYi?B|#JI
z%h82EVXYrgE^j~uE^iSD2E>h|ph$fl_9n=5GCBDh<lU+Lc$M%(kw@$G_?;i$r?m|P
zIF)hq&J9xpLb>GJlnCyA#K!blEx(^1BldPvQjR1tK_?uF!*z6Y(CAL#_%$g^IkyDp
zc2z<?aE8zD4F(4XLk=8hN-25ya^JZA$M8S}TLN|4ECb+ARh14%)jw8pdgKF^x;Q`2
zQ(e;U5vU_RaDY?r&zv#<F88<1^E5z;N^Nu<ybgsD;^Gd(Y=c+h#fulh%E*t*?J2|q
z45S)$BJlg2K?ag`-)HY<O@PRZwzjquMT%}EysYhRtwV%uj#H3GB#lPf+S;<PuxLf@
zM>kSsi(oWqR%u&qET4E3h1iV@3eXqq8TE+jw+SQO8AKGvhM=xqWh3lObfp~!sC7rP
zAe%p=?bbO?S7>K8J<hrOcWSt^v*hab%a^BuFhiO8S^K)DB8+@?^Vg@h<+AJhTc>`c
zU(Ns7Fe^(L7_geyA_1R8UaP*|-kK(KSg2XDr0K;&31#tmL>|5h+jrKUo}OTsSy)&g
z0WRxgw2H|6*jPg5`u0}9I@|2tR1X*KRTr~B%3sWtkeZsBljCG#gGtz#n3(A7>}+a^
zM3yWqE`o9t6%*sc$L}q-@Zeq@j6fyzvF|~a0jy)7PL3q*+#Rw`N^nrnhpH-CeRZ`h
zGp+s{n#d{On_)wbi4=uD9X_NMCLLN;RV6Mi9<?H|C=PrUeMsBgVI?Ic$!*Q_OP%8o
zl%b~%lE>Y7Z8h4cZB9;WBbt$~zsveJ!XmUAHqC99#ygUSO(T_+l!^-qj=DiA$BCwa
zc?@TU3KPdz^sKTUi&!3GM;izjc4fjEfi|wDre3memUJ^7?IzZ?h^&p@=Ztc4N@^An
zY&vQ-ydGa)3b<o6YId^VwnuHbnn<*@rJps?t)-x|EGXc4qdc5}Y(?G(KtqZ-6e)6c
z5*fn-1I@dSAf)8mH<<&MH$etd-4f|J720ZaS1RegOwbUNa}TQ(ez0%-6umj~C@84L
zMN{!Z)a@1f3l}b6Fq7bA9ou$c`rxZM)nRC51#WV*-@tprXS+L}LR(n_0|Tq8{>I@!
z?#X}9g*D~cnQ9H6$VQKq4_X!#6>;H`Orzf>!y_Uh4EE!!vL?)ddy{N9t*?l!p0f{6
z4zx_WDjSC<Zs0;g!JCygMF+Pi=8V<&!aKw%b7e^&gKy5n#H1Ae8gH<(p2kUml?kW2
z0yMhAns@1?xxTA0+s(~JV~BR{Y6BG&mGkG#0gPk^xuS+<#(2}g^x|z278Gn^*8p$9
zh_=Y#)DyG(IG6Li5`<$=!Y;qu5{t8xNF+AiS(7ObuSXJ%c8zlH#rfQorSpO3@Z<U>
zV?pHzolH3DOvuVg2&Ny71#>L4G6%>ZkejuCboWqp8X+f#w;FZr+TieTd?41#%j@$M
zxMS<+n`{>YHMM3xj(Uk>5j)I{x;njyaGe~#Teq(21hC@kEzY+{H0V<leRM_`wJEu|
ze1j#0g~sod-?4P!KxA*OKK+HH3cGGQR__sL<QW<9){R9)N#vdjeG^;Gjv+F~b&>XW
zG|rqk=tuana+;tFIUnZhjz<6Le}$MEv?Vv#7CUxzcCz7u_OvEL)lyuC)`r($60opm
z0cyDmSt%)OwT<B{t<|s-<6RdXmUSRNb>CWg$LcE!2gCHEd6&dkKKM}3#K{hPBPhA>
z@bKWJQ46w&+Xr0YN~ww0P#}1QFSq-SJxA-F()kr?XE!`zP9?BpWMqyB32AC-nlDs~
zp|RHjFng<$Ju53Kqoc^8>sb>1vx=-L{JVGWCMPGS5<)=-lsUK^Mz0GB`!+D}vfl$u
zX>iwV2XyZ_CyRqd@l{<~GdP+&@;K*Dpnj&AD7qCEYSrD=HtN&y(bWKr@Ps{n1mg8U
ze2}`tz~+x1KeDs4MF`Zzjk=)QOqW97UD$y`1FE4?Wx|in;pk>UH&@uG6iSi`fk1!?
z=RIKNLq;xDonf;>1_Y>=>m3};ya4!KjL|<#*=9K0+EDS1v@Q59(v1k=e3k^;VkP+8
zQ2xU52bE-35qqg)v#7BV+7dVh6%~z!OSN;Tm@fbQ_usVL{N6EF*w%;2%Evo+DflaG
z0UW<wdF;HBf<oc@_suHeLA?@%FNfx7L@-||FE6*2x0&g>_J|OYHJs07QW4>37^+-l
zMl=R|yHmkf$gUt7tu5`x%gYOTMd1FWz&Oy`txXfTxw&JD)>NZy!{>Ue^j`0Ki^zoh
zJVn>SbV&^BW<}k7-uLEbw9W^x28fA?*<`U|i(zj2lTC^)x~prx-tH9w6_gI#J-^6!
z@ZiBAUS9nm;8}Gw19Fz{MwF$$ZqnDtO2hKe+;~vFr&&Eul?l4Ri(qcHyui-RZU}l<
z+*s4y5(<MeV$t*9?m+ocWwrN_DFg!XXynr1h&n$mtK1Dj<(s31ttI8>=f}pz*4DDX
z;2XS$b0`0z-tDl;wMi69(RVkAs;STWEz$Di#6&&+iB2$M(Z-I};dhw4-i_-{<=*=@
zW>uj0Clo)$oqYKd@%3>E!!0zaV(iEVUq-nFRdJMmYZvCdJd50GyAk2xVb;Bs^AAIV
zz3=@Mm)de$p8|N({6TZQGQ!C}r*3<?so5b~#mm9Lu|FE#9bcbk+;kL&8%Eg&y>6IV
z1YP$ROX6vI`BQzs6{ZuWi)b+oOs&Vu%Au8IaAa!t$9@Xsi)o<RKCCqTSLT!OD>E1^
z9<0B=6;tZd@l$lPfIA^{-N@Bd3KyF0D1f`fk5i2=O&&Sn=;XwUB`W>w=Bs-|PUw+g
zosPv$OgLO=l%`)yQ>2@p>{kh`M=F2mc>UuHxD=e;KVtdz``nv1GGWqH=Z69W%7oJ-
zSq1$EF&GS(*Mb?Oe@)DvU3t@0b))<P0_OiDBE0*fzezmQl?B%Y4YmL2<Hyb(9dA5)
zhGvplk&ZzBnVZY+h43oO_wV07e8~5XVlx{VSO1KBO|TcZw%wNnP3}?)vxPpt1|B5}
zBlSYPLivl*H?JyS^swhHdv~@m(8k##0fk1ecy|0FV(vsP&Ck1DTf{6Z|6z~vJC3VD
z`B+*)6ePwlq3jX&e=~ojA;OxQ3A>7T<{sgv6de0obm$0NJK3Pnr~NtKw|-GKMnKW?
zxE+O1SFd}srYi9}KCjr8P0_@Pf2!U8C`$t5|6XoIc7bK^e<1!<ApbAMKU-h%0SaXF
zuljsa5of>Ycx(qM-p3fSwS-&!{^7vJcGdE#1=#KXGXP)KRu?XT9s6(ag5?#k<NXa{
zTs{1-ipDN}u9yp!7QZRDz=rX2XS235`OWGN0sOKN2p$HTo{gUy=BB3~#tmkD)kGEi
z@_W7o7JbLs+*%C;p<pxecL~CHU|jqIC9OR$z8Fclf7X%o$M|}NfD``v{8s}1pAz^V
D#nQzE

diff --git a/tests/data/compressed_id3_frame_invalid.mp3 b/tests/data/compressed_id3_frame_invalid.mp3
new file mode 100644
index 0000000000000000000000000000000000000000..824d036fa4459e57ad671a8c3bb910e384b94ff2
GIT binary patch
literal 5000
zcmeG=c{r5q*MwAJBBCs#2+6*dWf)<oq*o-{48vqMy$BhGPzVvFtkWiyeM_=t-!h@b
zNMlTP9y>G4SiYy;Kfd?+UEkl|U%%(N?&m)DbMABQ`#$H~XL-zx)j8O}M?nLA)%*e*
z+Yu+WNN|`HlD&|_ayV*xqGKVVETVb$gMn`?rDL(8ibUE#*4i(1a}*pC;&PCGDM^-(
zBXc>$beh2ZPBA2(K6f-$`YQz&DbFq__}Jl)P{GZ{36IRwt|I~$Z%)-w-BaCjyE4);
z*3K_YUhcbmY=P3~UEP8DNryUCdi1B-(B?-SG>RB2Om(DZNZ$Cy=u3l)4-p&mfJ;u>
z1;UD9N`nBZ{>}v+EKk{V@Jaf%Qfn^t9{FsLs=cQvJ6bubEpyUQ^OX@=**2vWDW7oZ
zMxRY9@}#8rkzl}yGA57;4A*{QpOl|Z4^+k3Y9Bx_TZU_yoaS1Z+Vo<W{XkeZ66~)G
zY$uS{&Z3DWar%v?=-Xa2viIe=xjFwg_h~ej>14Oh@=Hrg!K;sbySCajl%!d$t*s=|
z_2|!Imw7!b{@^>h<~Ep>m6dl&jtjm2?p2wu{zO3zC!1v$1Y~$!&SZGGFv{JrH5AgP
zJ3J>;zr1ELLqB6PGBcYIa*@qKLPGS~47;<!diW4ZVWC1;OfYayXdc_@^8AX}voS_y
z^06Qv@j&BH>0qGWaDUoYQj|L%UQQh&;84A{-1?i&+4Xdpa1bKnIM*$ac$tIkH-UsD
zG=*!P<P<~RyFTzUs&}l=yTvr%IB8K`el{ZixT%)+<S*c4OprJI?IFxp9+#b82yczs
zlDLM)@w)UW#T#XQGslgtz3e^Qo*A4;BfA$lE^q#Ier@aRk-#EGlsa3;^%qqm?tP}N
zC+8*10jl3!-?H231|v)*ATG#d!EcWiZ>to=eszUEfssC9H|>f$*v>zt)mz;8DPNwT
zFV$+_Ee7Kf-6z{ia&bH5xMHF}9x-quRQZ1%=f<ufmq*pf6}SA9JafWswD0R_PDgp2
zEwJIkRr2&@+sTi*93d&TUA$SJ=FFFzbaTk-Z1)cxy_Ig0Fxc7%DO(|SOwLpPP}7S{
zOR;=~XVVqkMYZ<?$m%ct>Lu70Cp@i8&-3Ow$QmZv*L1E#ABXvGmJ5wIy^eIARC6Vk
zOH3CC@L&1>&*3Fauc$3RLouGkXm%qlz`?>kaw<B$bjg2;SynYwZ{)6_oK$lQFt<8d
zHf`IQi{i)OO@J+-KZ9#_(X#ZqxPP0~ga3Pw$$@JwQTd1V$?9;U>g>k+Pzkc0xiN%7
zHH4kl)ZF;h##84i?ocXDC`T8=$XriSht;zUd3w{*(#FTfrKF^Yx%#3fPMi=EYt<!{
zagE5z$b1$33i&w4`2a)o5l`nWX4_t$9c*Z5;D$)d1b!lsNa^Xv>Z+@&gKyuS-C*wS
z;sfuMm8lAvBH+Qa7u<4b`W%o4`=i-q_&!M%efK&mFRyXJ!o`J_B&xlPw6e0ge*L<W
zlM@P+jE_WH=IX%_aEM{P3#{pT{wnvy4B&Xkxqwmt0168V&MGPOb#|JWnSBgdLA$xR
z85?tszIyo*?dl3{zM`U{AM*8JW>!{hZ7of@R5@Yaq4p9(`g5+ErB0H-%*@;O@Auh1
zxp;f3HzP8V4TYk%#6oa59BXsanL?!+oIAG(3|I8`_n$d)W|@12-PhOmz>$`gmQDe|
zL{tXgQZ5-g!<Ukgks++)c;N8i_0`qY<z;e1I4fPzK?^&Y$nYKcP*YR0FkCS`_Bk4l
z$LC+kiLy1bv_v?1cz75dFjR|!y|&&y<d%Gyw<)DTQ%mcZpdj1y%6JE3ky7h9_~!OJ
zsmQ)+4z*P2KiRG6O)5k+N<bHWRP_uF9@UprP&oX8UH6oM;SxJO&%SZraP(2Npc{&b
z5`KEpo3Z1f5YC7?*=;N;Yj2A6jeGArlh#+Cpj~WN9yVN#nc<${6xH&H6g?L>^R+8Y
zmR}0oeI%3yRhoE;!n<@e7Fhbh@(k%_{cxT$qeTwY)_C_l1|wS7WN%S?r)lSv@>3<J
zPhnfDRo+8>lux&*4dHM&ys6}RfhwmVfN(cjH3RaL45MDPKU-iz%6@%Qd|CkoC@aaz
zFczTB$rZykhTs!{LX)=}^YXaHxmx+}Wi+6Nsa<kq(7HQt$r~%P{$sHlQtYi?B|#JI
z%h82EVXYrgE^j~uE^iSD2E>h|ph$fl_9n=5GCBDh<lU+Lc$M%(kw@$G_?;i$r?m|P
zIF)hq&J9xpLb>GJlnCyA#K!blEx(^1BldPvQjR1tK_?uF!*z6Y(CAL#_%$g^IkyDp
zc2z<?aE8zD4F(4XLk=8hN-25ya^JZA$M8S}TLN|4ECb+ARh14%)jw8pdgKF^x;Q`2
zQ(e;U5vU_RaDY?r&zv#<F88<1^E5z;N^Nu<ybgsD;^Gd(Y=c+h#fulh%E*t*?J2|q
z45S)$BJlg2K?ag`-)HY<O@PRZwzjquMT%}EysYhRtwV%uj#H3GB#lPf+S;<PuxLf@
zM>kSsi(oWqR%u&qET4E3h1iV@3eXqq8TE+jw+SQO8AKGvhM=xqWh3lObfp~!sC7rP
zAe%p=?bbO?S7>K8J<hrOcWSt^v*hab%a^BuFhiO8S^K)DB8+@?^Vg@h<+AJhTc>`c
zU(Ns7Fe^(L7_geyA_1R8UaP*|-kK(KSg2XDr0K;&31#tmL>|5h+jrKUo}OTsSy)&g
z0WRxgw2H|6*jPg5`u0}9I@|2tR1X*KRTr~B%3sWtkeZsBljCG#gGtz#n3(A7>}+a^
zM3yWqE`o9t6%*sc$L}q-@Zeq@j6fyzvF|~a0jy)7PL3q*+#Rw`N^nrnhpH-CeRZ`h
zGp+s{n#d{On_)wbi4=uD9X_NMCLLN;RV6Mi9<?H|C=PrUeMsBgVI?Ic$!*Q_OP%8o
zl%b~%lE>Y7Z8h4cZB9;WBbt$~zsveJ!XmUAHqC99#ygUSO(T_+l!^-qj=DiA$BCwa
zc?@TU3KPdz^sKTUi&!3GM;izjc4fjEfi|wDre3memUJ^7?IzZ?h^&p@=Ztc4N@^An
zY&vQ-ydGa)3b<o6YId^VwnuHbnn<*@rJps?t)-x|EGXc4qdc5}Y(?G(KtqZ-6e)6c
z5*fn-1I@dSAf)8mH<<&MH$etd-4f|J720ZaS1RegOwbUNa}TQ(ez0%-6umj~C@84L
zMN{!Z)a@1f3l}b6Fq7bA9ou$c`rxZM)nRC51#WV*-@tprXS+L}LR(n_0|Tq8{>I@!
z?#X}9g*D~cnQ9H6$VQKq4_X!#6>;H`Orzf>!y_Uh4EE!!vL?)ddy{N9t*?l!p0f{6
z4zx_WDjSC<Zs0;g!JCygMF+Pi=8V<&!aKw%b7e^&gKy5n#H1Ae8gH<(p2kUml?kW2
z0yMhAns@1?xxTA0+s(~JV~BR{Y6BG&mGkG#0gPk^xuS+<#(2}g^x|z278Gn^*8p$9
zh_=Y#)DyG(IG6Li5`<$=!Y;qu5{t8xNF+AiS(7ObuSXJ%c8zlH#rfQorSpO3@Z<U>
zV?pHzolH3DOvuVg2&Ny71#>L4G6%>ZkejuCboWqp8X+f#w;FZr+TieTd?41#%j@$M
zxMS<+n`{>YHMM3xj(Uk>5j)I{x;njyaGe~#Teq(21hC@kEzY+{H0V<leRM_`wJEu|
ze1j#0g~sod-?4P!KxA*OKK+HH3cGGQR__sL<QW<9){R9)N#vdjeG^;Gjv+F~b&>XW
zG|rqk=tuana+;tFIUnZhjz<6Le}$MEv?Vv#7CUxzcCz7u_OvEL)lyuC)`r($60opm
z0cyDmSt%)OwT<B{t<|s-<6RdXmUSRNb>CWg$LcE!2gCHEd6&dkKKM}3#K{hPBPhA>
z@bKWJQ46w&+Xr0YN~ww0P#}1QFSq-SJxA-F()kr?XE!`zP9?BpWMqyB32AC-nlDs~
zp|RHjFng<$Ju53Kqoc^8>sb>1vx=-L{JVGWCMPGS5<)=-lsUK^Mz0GB`!+D}vfl$u
zX>iwV2XyZ_CyRqd@l{<~GdP+&@;K*Dpnj&AD7qCEYSrD=HtN&y(bWKr@Ps{n1mg8U
ze2}`tz~+x1KeDs4MF`Zzjk=)QOqW97UD$y`1FE4?Wx|in;pk>UH&@uG6iSi`fk1!?
z=RIKNLq;xDonf;>1_Y>=>m3};ya4!KjL|<#*=9K0+EDS1v@Q59(v1k=e3k^;VkP+8
zQ2xU52bE-35qqg)v#7BV+7dVh6%~z!OSN;Tm@fbQ_usVL{N6EF*w%;2%Evo+DflaG
z0UW<wdF;HBf<oc@_suHeLA?@%FNfx7L@-||FE6*2x0&g>_J|OYHJs07QW4>37^+-l
zMl=R|yHmkf$gUt7tu5`x%gYOTMd1FWz&Oy`txXfTxw&JD)>NZy!{>Ue^j`0Ki^zoh
zJVn>SbV&^BW<}k7-uLEbw9W^x28fA?*<`U|i(zj2lTC^)x~prx-tH9w6_gI#J-^6!
z@ZiBAUS9nm;8}Gw19Fz{MwF$$ZqnDtO2hKe+;~vFr&&Eul?l4Ri(qcHyui-RZU}l<
z+*s4y5(<MeV$t*9?m+ocWwrN_DFg!XXynr1h&n$mtK1Dj<(s31ttI8>=f}pz*4DDX
z;2XS$b0`0z-tDl;wMi69(RVkAs;STWEz$Di#6&&+iB2$M(Z-I};dhw4-i_-{<=*=@
zW>uj0Clo)$oqYKd@%3>E!!0zaV(iEVUq-nFRdJMmYZvCdJd50GyAk2xVb;Bs^AAIV
zz3=@Mm)de$p8|N({6TZQGQ!C}r*3<?so5b~#mm9Lu|FE#9bcbk+;kL&8%Eg&y>6IV
z1YP$ROX6vI`BQzs6{ZuWi)b+oOs&Vu%Au8IaAa!t$9@Xsi)o<RKCCqTSLT!OD>E1^
z9<0B=6;tZd@l$lPfIA^{-N@Bd3KyF0D1f`fk5i2=O&&Sn=;XwUB`W>w=Bs-|PUw+g
zosPv$OgLO=l%`)yQ>2@p>{kh`M=F2mc>UuHxD=e;KVtdz``nv1GGWqH=Z69W%7oJ-
zSq1$EF&GS(*Mb?Oe@)DvU3t@0b))<P0_OiDBE0*fzezmQl?B%Y4YmL2<Hyb(9dA5)
zhGvplk&ZzBnVZY+h43oO_wV07e8~5XVlx{VSO1KBO|TcZw%wNnP3}?)vxPpt1|B5}
zBlSYPLivl*H?JyS^swhHdv~@m(8k##0fk1ecy|0FV(vsP&Ck1DTf{6Z|6z~vJC3VD
z`B+*)6ePwlq3jX&e=~ojA;OxQ3A>7T<{sgv6de0obm$0NJK3Pnr~NtKw|-GKMnKW?
zxE+O1SFd}srYi9}KCjr8P0_@Pf2!U8C`$t5|6XoIc7bK^e<1!<ApbAMKU-h%0SaXF
zuljsa5of>Ycx(qM-p3fSwS-&!{^7vJcGdE#1=#KXGXP)KRu?XT9s6(ag5?#k<NXa{
zTs{1-ipDN}u9yp!7QZRDz=rX2XS235`OWGN0sOKN2p$HTo{gUy=BB3~#tmkD)kGEi
z@_W7o7JbLs+*%C;p<pxecL~CHU|jqIC9OR$z8Fclf7X%o$M|}NfD``v{8s}1pAz^V
D#nQzE

literal 0
HcmV?d00001

diff --git a/tests/test_id3v2.cpp b/tests/test_id3v2.cpp
index cac2b952..9087b54e 100644
--- a/tests/test_id3v2.cpp
+++ b/tests/test_id3v2.cpp
@@ -1121,7 +1121,7 @@ public:
 
   void testCompressedFrameWithBrokenLength()
   {
-    MPEG::File f(TEST_FILE_PATH_C("compressed_id3_frame.mp3"), false);
+    MPEG::File f(TEST_FILE_PATH_C("compressed_id3_frame_invalid.mp3"), false);
     CPPUNIT_ASSERT(f.ID3v2Tag()->frameListMap().contains("APIC"));
 
     if(zlib::isAvailable()) {
@@ -1132,7 +1132,7 @@ public:
       CPPUNIT_ASSERT_EQUAL(String("image/bmp"), frame->mimeType());
       CPPUNIT_ASSERT_EQUAL(ID3v2::AttachedPictureFrame::Other, frame->type());
       CPPUNIT_ASSERT_EQUAL(String(""), frame->description());
-      CPPUNIT_ASSERT_EQUAL(static_cast<unsigned int>(86414), frame->picture().size());
+      CPPUNIT_ASSERT_EQUAL(static_cast<unsigned int>(142), frame->picture().size());
     }
     else {
       // Skip the test if ZLIB is not installed.