mirror of
https://github.com/taglib/taglib.git
synced 2026-08-27 12:47:01 -04:00
Same shape as the DSF change: sampleCount comes from a chunk size in the
file and sampleRate is read from it, so
static_cast<int>(static_cast<double>(d->sampleCount) * 1000.0
/ d->sampleRate + 0.5)
can be handed a value int cannot represent, which is undefined.
In the PR I said I had not demonstrated this one, because chunkFits
bounds the sample count by the file length so a few mutated bytes will
not do it. Constructing the file it does need - a 700 kB DSD chunk with
a sample rate of 1 - reaches it:
taglib/dsdiff/dsdiffproperties.cpp:61:24: runtime error: 2.8e+09 is
outside the range of representable values of type 'int'
Two reports before the change, none after. tests/data/empty10ms.dff is
unchanged at lengthMs=10 bitrate=5644 rate=2822400 ch=2.
Assisted-By: Claude Code (Claude Opus 5)