From 2193d6dd84a16603017c2904f7fbf2160b88f2ce Mon Sep 17 00:00:00 2001
From: Tsuda Kageyu <tsuda.kageyu@gmail.com>
Date: Thu, 8 Jan 2015 12:05:17 +0900
Subject: [PATCH] Fix an out-of-bounds access and consequent errors while
 parsing fuzzed MPC files. Consequent errors may vary: segfault, zerodiv and
 so forth.

---
 taglib/mpc/mpcproperties.cpp |  20 +++++++++++---------
 tests/data/zerodiv.mpc       | Bin 0 -> 405 bytes
 tests/test_mpc.cpp           |   9 ++++++++-
 3 files changed, 19 insertions(+), 10 deletions(-)
 create mode 100644 tests/data/zerodiv.mpc

diff --git a/taglib/mpc/mpcproperties.cpp b/taglib/mpc/mpcproperties.cpp
index d406f8d7..f11f8ecf 100644
--- a/taglib/mpc/mpcproperties.cpp
+++ b/taglib/mpc/mpcproperties.cpp
@@ -183,7 +183,9 @@ unsigned long readSize(const ByteVector &data, TagLib::uint &sizelength)
   return size;
 }
 
-static const unsigned short sftable [4] = { 44100, 48000, 37800, 32000 };
+// This array looks weird, but the same as original MusePack code found at:
+// https://www.musepack.net/index.php?pg=src
+static const unsigned short sftable [8] = { 44100, 48000, 37800, 32000, 0, 0, 0, 0 };
 
 void MPC::Properties::readSV8(File *file)
 {
@@ -207,17 +209,17 @@ void MPC::Properties::readSV8(File *file)
       d->sampleFrames = readSize(data.mid(pos), pos);
       ulong begSilence = readSize(data.mid(pos), pos);
 
-      std::bitset<16> flags(TAGLIB_CONSTRUCT_BITSET(data.toUShort(pos, true)));
+      const ushort flags = data.toUShort(pos, true);
       pos += 2;
 
-      d->sampleRate = sftable[flags[15] * 4 + flags[14] * 2 + flags[13]];
-      d->channels = flags[7] * 8 + flags[6] * 4 + flags[5] * 2 + flags[4] + 1;
+      d->sampleRate = sftable[(flags >> 13) & 0x07];
+      d->channels   = ((flags >> 4) & 0x0F) + 1;
 
-      if((d->sampleFrames - begSilence) != 0)
-        d->bitrate = (int)(d->streamLength * 8.0 * d->sampleRate / (d->sampleFrames - begSilence));
-      d->bitrate = d->bitrate / 1000;
-
-      d->length = (d->sampleFrames - begSilence) / d->sampleRate;
+      const uint frameCount = d->sampleFrames - begSilence;
+      if(frameCount != 0 && d->sampleRate != 0) {
+        d->bitrate = (int)(d->streamLength * 8.0 * d->sampleRate / frameCount / 1000);
+        d->length  = frameCount / d->sampleRate;
+      }
     }
 
     else if (packetType == "RG") {
diff --git a/tests/data/zerodiv.mpc b/tests/data/zerodiv.mpc
new file mode 100644
index 0000000000000000000000000000000000000000..d3ea57c75ca8a58f8bcc9bf0388935d59f8d70d5
GIT binary patch
literal 405
zcmeYbaP|)N;Gg>Ipa@4}XS)kS0|OX1<|LKoGB_oA<RqpPvp~cc9E(aai%S@?N{dSr
z((;QGN>YnU*r0Omshf*Zff{mv8pNPtA(<sPsSLRVj4*ytVsbWvA<Q_SXh>!>Pz6wf
z0!T@+LUF5wf&$P~h4RdjjQ>DT4AJ|VAp})#WNKm&gS~-)fn$Jch@-n}`~`LfhLsE)
z3~X^FD3+ip)Jy}q&kSN6Lx=zalI;x9V8`SZpgQCK|B}RXJkI!o<P6RD3vD20Fff3E
drGbGVF*yd|Uo@w<MqCg@Q4Cbi1k}dB005C6T2%l5

literal 0
HcmV?d00001

diff --git a/tests/test_mpc.cpp b/tests/test_mpc.cpp
index 12da6ed3..d7239a6d 100644
--- a/tests/test_mpc.cpp
+++ b/tests/test_mpc.cpp
@@ -1,10 +1,10 @@
-#include <cppunit/extensions/HelperMacros.h>
 #include <string>
 #include <stdio.h>
 #include <tag.h>
 #include <tstringlist.h>
 #include <tbytevectorlist.h>
 #include <mpcfile.h>
+#include <cppunit/extensions/HelperMacros.h>
 #include "utils.h"
 
 using namespace std;
@@ -17,6 +17,7 @@ class TestMPC : public CppUnit::TestFixture
   CPPUNIT_TEST(testPropertiesSV7);
   CPPUNIT_TEST(testPropertiesSV5);
   CPPUNIT_TEST(testPropertiesSV4);
+  CPPUNIT_TEST(testFuzzedFile1);
   CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -61,6 +62,12 @@ public:
     CPPUNIT_ASSERT_EQUAL(44100, f.audioProperties()->sampleRate());
   }
 
+  void testFuzzedFile1()
+  {
+    MPC::File f(TEST_FILE_PATH_C("zerodiv.mpc"));
+    CPPUNIT_ASSERT(f.isValid());
+  }
+
 };
 
 CPPUNIT_TEST_SUITE_REGISTRATION(TestMPC);
-- 
2.40.0