TagLib QuickTime chapter stsc samples_per_chunk allocation abort via unchecked sample table consistency

[Lee, Brian J]

Hello,

My name is Brian Lee, and I am a PhD Security Researcher in SSLab at Georgia Tech. I'd like to privately report a potential security bug in taglib regarding A crafted MP4 crashes a desktop media application, thumbnailer, or local metadata extraction worker that calls TagLib qtChapters() on untrusted media. This is a denial of service of the parsing process. Because the github advisory was not open, we decided to contact one of the maintainers.

Target:

  *
Project: taglib
  *
Repo: https://github.com/taglib/taglib
  *
Pinned ref: a27dca557e85db1e23de33d2118cde87c8f32770


Threat Model:
The attacker supplies a crafted MP4 file with a valid ftyp, an audio track, and a tref/chap reference to a text chapter track. The chapter track declares one sample in stsz but declares 0x20000000 samples_per_chunk in stsc. When the victim application asks TagLib for QuickTime chapters, TagLib follows the chapter reference and expands per-sample offsets using the attacker-controlled stsc value before checking the actual sample count, causing the parser process to exhaust its allocation budget and abort with std::bad_alloc.

Attached:
https://drive.google.com/file/d/1wp70zSg1U6RGM_8uM201jvG7xwTH-Nyz/view?usp=sharing
When reporting by email, for better readability of the email and for those who prefer private channels when discussing security bugs, we share the full writeup and PoC files via zip file attachment. If you don't want to download an arbitrary zip file and use it, please let us know. The zip file contains:

  *
README.md : full writeup.
  *
poc : the relevant files and scripts for reproducing the PoC

I would like to get help from your expertise to clarify whether this is a valid security threat or not. Thank you.

Best Regards,
Brian Lee

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/taglib-devel/attachments/20260714/0ff3c6e6/attachment.htm>