Skip to content

Corrupt output if metadata block too large #26

@asnare

Description

@asnare

Metadata blocks are limited to 16 MiB (+4 bytes) in size by the FLAC specification. At present this limit is not checked when writing out a FLAC file:

writer.write_all(&content_len.to_be_bytes()[1..])?;

The impact is that when the metadata block encodes to a larger size the resulting file will be corrupt because the length value in the header doesn't match the length of the data that was written. This is most likely to happen with PICTURE or APPLICATION blocks.

For reference, the official library checks for overly large metadata in several locations but there's a final check when writing out the header for a metadata block:

	FLAC__ASSERT(block->length < (1u << FLAC__STREAM_METADATA_LENGTH_LEN));
	/* double protection */
	if(block->length >= (1u << FLAC__STREAM_METADATA_LENGTH_LEN))
		return false;

with:

FLAC_API const uint32_t FLAC__STREAM_METADATA_LENGTH_LEN = 24; /* bits */

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions