[vlc-commits] [Git][videolan/vlc][3.0.x] contrib: taglib: fix crash in WAV

[Felix Paul Kühne (@fkuehne)]

Felix Paul Kühne pushed to branch 3.0.x at VideoLAN / VLC


Commits:
0d219619 by Steve Lhomme at 2026-07-08T09:52:44+02:00
contrib: taglib: fix crash in WAV

Fixes CVE-2023-47466 [^1].

[^1]: https://github.com/taglib/taglib/issues/1163

- - - - -


2 changed files:

- + contrib/src/taglib/0001-Fix-crash-with-invalid-WAV-files-1163-1164.patch
- contrib/src/taglib/rules.mak


Changes:

=====================================
contrib/src/taglib/0001-Fix-crash-with-invalid-WAV-files-1163-1164.patch
=====================================
@@ -0,0 +1,32 @@
+From cecbdf4d638cace945a99cbe923565d0767921c9 Mon Sep 17 00:00:00 2001
+From: Urs Fleisch <ufleisch at users.sourceforge.net>
+Date: Sun, 5 Nov 2023 14:40:18 +0100
+Subject: [PATCH] Fix crash with invalid WAV files (#1163) (#1164)
+
+With specially crafted WAV files having the "id3 " chunk as the
+only valid chunk, when trying to write the tags, the existing
+"id3 " chunk is removed, and then vector::front() is called on
+the now empty chunks vector.
+Now it is checked if the vector is empty to avoid the crash.
+---
+ taglib/riff/rifffile.cpp     |   3 +++
+ 3 files changed, 21 insertions(+)
+ create mode 100644 tests/data/invalid-chunk.wav
+
+diff --git a/taglib/riff/rifffile.cpp b/taglib/riff/rifffile.cpp
+index 005551f4..f615e6c7 100644
+--- a/taglib/riff/rifffile.cpp
++++ b/taglib/riff/rifffile.cpp
+@@ -361,6 +361,9 @@ void RIFF::File::writeChunk(const ByteVector &name, const ByteVector &data,
+ 
+ void RIFF::File::updateGlobalSize()
+ {
++  if(d->chunks.empty())
++    return;
++
+   const Chunk first = d->chunks.front();
+   const Chunk last  = d->chunks.back();
+   d->size = last.offset + last.size + last.padding - first.offset + 12;
+-- 
+2.52.0.windows.1
+


=====================================
contrib/src/taglib/rules.mak
=====================================
@@ -16,6 +16,7 @@ $(TARBALLS)/taglib-$(TAGLIB_VERSION).tar.gz:
 taglib: taglib-$(TAGLIB_VERSION).tar.gz .sum-taglib
 	$(UNPACK)
 	$(APPLY) $(SRC)/taglib/0001-Implement-ID3v2-readStyle-avoid-worst-case.patch
+	$(APPLY) $(SRC)/taglib/0001-Fix-crash-with-invalid-WAV-files-1163-1164.patch
 	$(MOVE)
 
 TAGLIB_CONF := -DBUILD_BINDINGS=OFF -DCMAKE_POLICY_VERSION_MINIMUM=3.5



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/0d219619c6c6aaf77719bbd5e5e0850223f59f5a

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/0d219619c6c6aaf77719bbd5e5e0850223f59f5a
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help