search

dhowden / tag

ID3, MP4 and OGG/FLAC metadata parsing in Go
BSD 2-Clause "Simplified" License
558 stars 72 forks source link

OOM on malformed input #73

Closed Google-Autofuzz closed 4 years ago

Google-Autofuzz commented 4 years ago

The attached sample results in an OOM with the following code:

func Fuzz(in []byte) {
    r := bytes.NewReader(in)

    tag.Identify(r)

    m, err := tag.ReadFrom(r)
    if err != nil {
        return
    }

    m.Format()
    m.FileType()
    m.Title()
    m.Album()
    m.Artist()
    m.AlbumArtist()
    m.Composer()
    m.Year()
    m.Genre()
    m.Track()
    m.Disc()
    m.Picture()
    m.Lyrics()

    tag.Sum(r)
}

clusterfuzz-testcase-minimized-getmeta_fuzz-5100947594543104.zip