From 9ad487ef2a4eb8f5330dbc4315a912621e13d9f0 Mon Sep 17 00:00:00 2001
From: Devon Kirk <hyder365@users.noreply.github.com>
Date: Sat, 20 Jun 2026 19:11:34 -0400
Subject: [PATCH] tag: limit ID3 tag size

---
 src/tag/Id3Load.cxx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/tag/Id3Load.cxx b/src/tag/Id3Load.cxx
index 0524c4fce3..9fd394c6dc 100644
--- a/src/tag/Id3Load.cxx
+++ b/src/tag/Id3Load.cxx
@@ -12,6 +12,7 @@
 #include <algorithm>
 
 static constexpr size_t ID3V1_SIZE = 128;
+static constexpr size_t MAX_ID3_TAG_SIZE = 4 * 1024 * 1024;
 
 [[gnu::pure]]
 static inline bool
@@ -46,6 +47,8 @@ try {
 		return nullptr;
 
 	const std::size_t tag_size = static_cast<std::size_t>(query);
+	if (tag_size > MAX_ID3_TAG_SIZE)
+		return nullptr;
 
 	/* Found a tag.  Allocate a buffer and read it in. */
 	if (tag_size <= sizeof(query_buffer))
@@ -185,7 +188,7 @@ try {
 	if (size == 0)
 		return nullptr;
 
-	if (size > 4 * 1024 * 1024)
+	if (size > MAX_ID3_TAG_SIZE)
 		/* too large, don't allocate so much memory */
 		return nullptr;