A parser tried for the file extension may leave the stream anywhere, and Matroska::File::read() starts at the current position, so a Matroska file under an extension whose parser rejects it gave a null FileRef.
findID3v2, nextFrameOffset and previousFrameOffset read raw bytes in
64 KB blocks instead of building a ByteVector per byte from 1 KB reads,
with the sync check in an isFrameSync(b1, b2) overload. Results are
unchanged; junk before or after the audio no longer makes opening slow.
An Audio element without SamplingFrequency or Channels now reads their
defaults (RFC 9559: 8000 Hz, one channel) instead of 0, and the track
is no longer skipped when BitDepth is absent too. A track without an
Audio element is still skipped.
ASCII whitespace (space, tab, CR, LF) is skipped before decoding, so
line-wrapped base64, such as a METADATA_BLOCK_PICTURE wrapped every 76
characters, decodes instead of returning an empty vector. Other
invalid characters still do.
A frame that cannot be read, such as one with an invalid ID, is now
skipped when another frame, padding or the end of the frames follows
where its size ends; anything else still ends the tag as before.
Previously every frame after it was dropped, and a save then deleted
them from the file.
Only the audio chunk (data, or SSND in AIFF) is clamped to the end of
the file when it declares more than the file holds, and its size is
rewritten before a chunk is appended after it. Any other chunk running
past the end, such as a trailing APEv2 tag, ends the chunk walk again,
so a save inserts new chunks ahead of it instead of losing them on the
next read.
When exactly one frame holds an edited key and its type can hold the
new value, setProperties() now updates that frame instead of deleting
it and appending a new one. A COMM or USLT keeps its language, a TXXX
its description's spelling, and each keeps its position and its stored
text encoding, which is promoted at render when the new text needs it.
When setAssumedCodePage(65001) supplies the charset for an INFO tag
whose file declares none, a field whose bytes are not valid UTF-8 is
now read as ISO 8859-1, the RIFF default, instead of as an empty
string. A code page the file declares is never second-guessed, and a
handler installed with setStringHandler() still takes precedence.
The entry count is a single byte, so a table of more than 255 children wrapped the count while still writing every child element ID, and readers took the surplus IDs as embedded frames. Render the first 255 with a matching count, as renderChplData does for Nero chapters.
Give raw access to the DISP chunks of a WAV file, in the way the bext
and iXML chunks already are: DISPData(), setDISPData() and
hasDISPData(). A file can hold several DISP chunks, one per clipboard
format, so they are read and written as a list in file order. The
DISP chunks are only rewritten on save when setDISPData() was called.
RIFF::File gains a protected appendChunk(), which creates a chunk even
when one with the same name exists; setChunkData() now uses it.
An IOStream over another stream that records writes, insertions,
removals and truncations in memory and applies them in one commit(),
moving each displaced byte at most once. bytesToMove() reports what
commit() would move, and writeTo() writes the result to another stream
instead. Opt-in; no File subclass changes.
See #1474.
If the standard library checks the index in std::vector::operator[]
(_GLIBCXX_ASSERTIONS, libc++ hardening modes), ByteVector::operator[]
and List::operator[] now check the index against their own size and
abort if it is out of range, as std::vector does.
The std::vector check alone is not enough: a ByteVector created by
mid() shares the buffer of the original byte vector, so an index past
the end of the smaller vector still passes it. List::operator[] walks
a std::list, which these checks do not cover.
Builds without these macros are unchanged; a GCC Release build of
libtag produces identical code. The Ubuntu CI job now builds with
-D_GLIBCXX_ASSERTIONS so that the tests run with the checks enabled.
String::data(Latin1) keeps only the low byte of each code point, so the
fast path wrote garbage for characters ISO 8859-1 cannot hold,
instead of '?' as documented in tcharset.h:
* When encoding into a legacy code page, characters which cannot be
* represented by the code page are replaced by '?'.
- WAV files being read evaluate the charset properly (overridable
via option by caller)
- WAV files being saved always use UTF-8 (they add a CSET chunk)
following the specification at
https://www.robotplanet.dk/audio/wav_meta_data/riff_mci.pdf#page=25
The code page charset can also be used for ID3v1 tags, both for
parsing and rendering.
For users in space restricted environments, there
is a build flag WITH_CHARSETTABLES to exclude the character tables.
---------
Co-authored-by: Urs Fleisch <[email protected]>
QuickTime chapter samples run back to back from media time 0, so when the
first chapter starts after 0, QtChapterList::write() prepends an untitled
placeholder sample to keep the absolute start times. TagLib's own reader
strips it again, but the chapter track's edit list played the whole media
from time 0, so AVFoundation and ffmpeg listed the placeholder as an
untitled first chapter.
The edit list now begins with an empty edit spanning the placeholder,
followed by the media from the first written chapter. The placeholder
sample is kept, so readers which ignore edit lists see the same chapters
as before. A list starting at 0 still gets a single edit.
testQTChapterListNonZeroFirstChapterEditList writes chapters at 1 s and
2 s and checks the chapter track's elst: an empty edit (media time -1) of
one second in the mvhd timescale, then the remaining duration from media
time one second. It also checks that a list starting at 0 gets a single
edit from media time 0, and that qtChapters() reads back exactly the
written chapters in both cases.
properties() merges the values of all frames mapping to the same key, in
frame order, so a key can be spread over several frames, e.g. two
comments without a description in different languages give
COMMENT=["hello", "hallo"]. setProperties() only kept a frame if its own
values equal the whole requested list, so none of these frames was kept,
and the list was then written as a single TXXX:COMMENT frame. This made
setProperties(properties()) lossy: the COMM frames and their languages
were replaced by a frame no comment reader looks for.
Before deciding which frames to delete, merge the values of the frames
holding a single key in frameList() order, as properties() does. If the
requested values for a key equal the merged ones, keep all of its frames
and do not create a new frame for it. TIPL and TMCL frames, and every key
whose values changed, are handled as before.
testSetPropertiesKeepsSpreadFrames covers the identity round trip on two
COMM frames, a request matching only one of them (kept as before), a
changed list (still a single TXXX), a key held by a TXXX and a COMM
frame (compared in frame order, not frame ID order), and a save and
reread of an MPEG file.
RIFF::Info::Tag::properties() passed the result of the failed property
key lookup, an empty string, to addUnsupportedData() instead of the
field ID. An INFO chunk with a field that has no property mapping
therefore reported an empty entry in unsupportedData(), and passing that
list to removeUnsupportedProperties(), which erases by ID, removed
nothing.
Report the field ID instead, decoded as Latin-1 to match how
removeUnsupportedProperties() encodes it.
The new test sets a mapped field (INAM) and an unmapped one (ITRK),
checks that unsupportedData() is ["ITRK"], and that
removeUnsupportedProperties() with that list removes ITRK and keeps
INAM.
When a save with WriteStyle::AvoidInsert moved an existing element to the
end of the segment and also added a new element, the new element was
written past the end of the file. New elements are given the old end of
the file as their offset before rendering, and that offset is then shifted
by the size change of each moved element, while the pass which lays out
the moved elements after rendering did not include the new ones.
This happens, for example, when the tags before the first cluster grow
beyond their slot and an attachment is added in the same save. The file
is left with zero bytes between the last element and the new one, the
segment size does not cover the new element, and the seek head points to
the wrong position, so the attachment cannot be read back.
The new elements are now laid out together with the moved elements,
contiguously up to the end of the segment, and their seek head entries are
updated as well.
testSaveTypesMoveAndAdd grows the tags of tags-before-cues.mkv and adds
an attachment in one AvoidInsert save, then checks that the cluster did
not move, that the children of the segment run contiguously to its
declared end, which is the end of the file, and that the tag and the
attachment read back.
EBML::minSize() chose the size length for an element's data size with
<= at each limit, so a size of exactly 2^(7n) - 1 (127, 16383, 2097151,
...) was rendered in n bytes with every value bit set. That is the
reserved "unknown size" value (RFC 8794 section 6.2), so a reader no
longer knows where the element ends. A tag value of exactly 127 bytes,
for example, saves without error but reads back as an empty string.
minSize() also returned 0 for any size from 0x7FFFFFFFF (32 GiB) up, so
renderVINT() wrote a size of zero bytes. Sizes up to 2^56 - 2 now use
size lengths 6 to 8; larger sizes still return 0, as no size length can
hold them.
testElementSizeLength checks minSize() on either side of the limit of
each size length from 1 to 8 bytes. testSaveElementSizeAtLengthLimit
saves titles of 126 to 128 and 16382 to 16384 bytes to no-tags.mka and
reads them back.
neroChapters() and qtChapters() parsed the whole atom tree again on first
use, although the file already holds it from opening. They now use the
parsed atoms, and parse them again after a save or strip, which can move
atoms.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
MasterElement permits up to one million elements per read. Segment
metadata sections each start a fresh counter, allowing small files
with empty elements to exhaust memory during parsing.
Share one count across segment sections and seek-head lookups. Bound
the count by file size, with a minimum for small valid files.
* docs: Reword property mapping notes
Use the present tense, refer to keys instead of tags, fix the comma
splice in the Matroska note, and describe the Matroska target level as
optional, with /30 (Track) used when none is given.
* docs: Fix ID3v2 TIPL and TMCL property mappings
ARRANGER, ENGINEER, PRODUCER, DJMIXER and MIXER are stored as roles in the
TIPL frame, and TMCL instrument/name pairs map to PERFORMER:<instrument>
keys. The INVOLVEDPEOPLE and MUSICIANCREDITS keys listed for these frames
don't exist in the code: their frameTranslation entries are commented out,
so both are written to TXXX like any unlisted key.
* docs: Widen ID3v2 column of property mapping table
Whitespace only, to make room for the TXXX descriptions added in the next
commit.
* docs: Document missing ID3v2 property mappings
- MUSICBRAINZ_TRACKID is stored in a UFID frame with owner
http://musicbrainz.org.
- MusicBrainz, AcoustID and MusicIP properties use fixed TXXX
descriptions from txxxFrameTranslation (e.g. MUSICBRAINZ_ALBUMID as
"MUSICBRAINZ ALBUM ID"), not the key.
- COMMENT, LYRICS and URL keys with a description suffix are stored in
COMM, USLT and WXXX frames with that description.
* docs: Describe MP4 freeform fallback and remove derivable names
MP4 keys without a listed name are stored in a freeform atom
(----:com.apple.iTunes: followed by the key), so cells repeating exactly
that name are redundant. The now empty LICENSE row is kept to list the
key.
* docs: Document MP4 rate atom for RATING
The code maps RATING to the MP4 rate atom, but it was missing from the
table entirely.
* docs: Fix Matroska target levels
The code maps RELEASEDATE to DATE_RELEASED at Album level (50), not Track
level (30). DATE_RECORDED for DATE uses the default level (30) and, unlike
TRACKNUMBER or REPLAYGAIN_TRACK_GAIN, has no Album-level counterpart to
tell apart, so its level is omitted.
* docs: Document Matroska REPLAYGAIN property mappings
The code maps ReplayGain properties to Matroska tags, but these were missing from the table entirely.
* docs: Note that RIFF INFO and ASF only support listed keys
Unlike the other formats, RIFF INFO and ASF don't store keys without a
listed name, and setProperties() returns them.
* docs: Fix ASF mapping for ASIN
The ASF attribute "ASIN" was incorrectly listed under AUDIOSOURCEWEBPAGE.
* docs: Document missing ASF attribute mappings
The code maps the ReplayGain properties to replaygain_* attributes and
further Windows Media attributes (e.g. WM/ToolName, IsVBR,
WM/MediaClassPrimaryID) to properties, but they were missing from the
table.
* docs: Document ASF content description fields
TITLE, ARTIST, COPYRIGHT and COMMENT are stored in the Content Description
Object (Title, Author, Copyright, Description) rather than as attributes,
so the empty ASF column made them look unsupported.
* docs: Remove stray ul tag from TextIdentificationFrame table
Null-separated text values create a ByteVector and String for each
tiny field. A 1 MB tag can allocate over 100 MB and abort
memory-limited applications.
Limit decoded values based on input size and stop before creating
String objects when the value count exceeds the budget.
A TCON frame with many legacy genre codes copies the remaining text
for every code. A small crafted tag can consume seconds of CPU.
Walk the original string by offset, compare mapped genres without
copying the suffix, and limit decoded codes by input size.
TagLib::offset_t is off_t on POSIX, which is a 32-bit signed type on
32-bit platforms built without _FILE_OFFSET_BITS=64 (e.g. Debian i386).
The RF64 support introduced in 2.3.2 clamps chunk sizes with
std::min<offset_t>(size, 0xffffffff): with a 32-bit offset_t the constant
converts to -1 and becomes the result, so chunkDataSize() returns
4294967295 and the WAV/AIFF/RIFF parsers misbehave. In read(), a declared
size above 2 GiB likewise turns negative before the clamping check.
Perform the clamping in 64-bit types instead. Fixes the test suite
failures (TestRIFF, TestWAV, TestAIFF) observed on Debian i386. The same
clamp in WAV::Properties is fixed as well.
[5f869755] gave the whole-file element budget the same value as the per-container
limit (50000). A real 6,027,872,050-byte .mka requires 99780 elements, so
MasterElement::read() returns false and the file is unopenable at every ReadStyle.
Raise the global bound to 1000000, leaving the per-level bound untouched. That is
~10x a large real file's requirement and still an order of magnitude below the
'millions of small elements' case the original commit guards against.
When saving a .wma file, ASF::File::save() does not validate the
header's headerSize field before using it in arithmetic. If its value
is below 30, an unsigned underflow and a subsequent integer overflow
cause FileStream::removeBlock() to compute a corrupted target offset,
resulting in an unbounded copy loop.
Credits for the discovery of this bug go to Ximena Molina Portilla,
Software Engineering student at Instituto Tecnológico de Costa Rica
(GitHub: @ximemolina).
Adds a libFuzzer target parsing arbitrary input through TagLib::FileRef,
a format magic dictionary, and a README with build and run instructions.
Fully decoupled from the normal build as discussed in #1431.
A QuickTime chapter track can provide large stco and stsc
tables. QtChapterList::resolveSampleOffsets() currently walks every stsc
entry for every chunk, so a file with N entries can force O(N²) work during
MP4::File::qtChapters(). A 3.2 MB file with 200,000 entries took about 20
seconds in the release build.
Keep a cursor into stscEntries and advance it as chunk numbers
increase. This resolves the same ordered table in linear time while
avoiding attacker-controlled repeated scans.
A malformed QuickTime chapter track can set stsz's default sample size to a
value larger than the available sample data. MP4::File::qtChapters() passes
that value through QtChapterList::read() to readTextSample(), allowing a
small file to cause gigabytes of allocations and terminate the application.
Check each resolved sample against the file end and the next sample offset
before reading it. Samples that do not fit are rejected without allocating
the attacker-controlled size.
The Matroska and MP4 parsers limited child elements per container, but
allowed that limit to repeat at every nesting level. A crafted media file
could therefore retain millions of small elements and exhaust process
memory while it was opened.
Carry a shared element count through recursive parsing so the existing
per-container limits also have a global bound.
A zero sample header size makes the sample loop consume no input,
allowing crafted instrument and sample counts to cause excessive CPU
and memory use during parsing.
Some trackers write zero sample header sizes, some trackers ignore
such values and assume a standard header size of 40 bytes. We do the
same to ensure the sample loop advances.
ASF header extensions trusted their nested data size and accepted
zero-sized child objects. A crafted file could make parsing continue
outside the enclosing object while retaining one object per child
header, exhausting process memory when opened.
Bound nested data to the enclosing object, require a complete child
header, and cap the nested object count.
Xiph comment lengths are read from the file. Without checking them
against the remaining packet, a wrapped length can reset the parser
position and make each field iteration copy the same payload.
Reject truncated vendor and field data before advancing the parser.
MinnieTheMoocherandGitHub
Ryan FrancesconiandGitHub
Nathan ChandrasekarandGitHub
Urs Fleisch
Acts1631andGitHub
FelipeandGitHub
Boyuan YangandUrs Fleisch
GarryHandGitHub
Stephen BoothandGitHub
roshanandGitHub