From 41c1c2b3609fc542e357cc80185d90a9a6fccc1a Mon Sep 17 00:00:00 2001 From: Urs Fleisch Date: Sun, 5 Nov 2023 14:40:18 +0100 Subject: [PATCH] Fix crash with invalid WAV files (#1163) (#1164) With specially crafted WAV files having the "id3 " chunk as the only valid chunk, when trying to write the tags, the existing "id3 " chunk is removed, and then vector::front() is called on the now empty chunks vector. Now it is checked if the vector is empty to avoid the crash. CVE: CVE-2023-47466 Upstream-Status: Backport [https://github.com/taglib/taglib/commit/dfa33bec0806cbb45785accb8cc6c2048a7d40cf] Signed-off-by: Jiaying Song --- taglib/riff/rifffile.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/taglib/riff/rifffile.cpp b/taglib/riff/rifffile.cpp index 005551f..f615e6c 100644 --- a/taglib/riff/rifffile.cpp +++ b/taglib/riff/rifffile.cpp @@ -361,6 +361,9 @@ void RIFF::File::writeChunk(const ByteVector &name, const ByteVector &data, void RIFF::File::updateGlobalSize() { + if(d->chunks.empty()) + return; + const Chunk first = d->chunks.front(); const Chunk last = d->chunks.back(); d->size = last.offset + last.size + last.padding - first.offset + 12; -- 2.34.1