From 41c1c2b3609fc542e357cc80185d90a9a6fccc1a Mon Sep 17 00:00:00 2001
From: Urs Fleisch <ufleisch@users.sourceforge.net>
Date: Sun, 5 Nov 2023 14:40:18 +0100
Subject: [PATCH] Fix crash with invalid WAV files (#1163) (#1164)

With specially crafted WAV files having the "id3 " chunk as the
only valid chunk, when trying to write the tags, the existing
"id3 " chunk is removed, and then vector::front() is called on
the now empty chunks vector.
Now it is checked if the vector is empty to avoid the crash.

CVE: CVE-2023-47466

Upstream-Status: Backport
[https://github.com/taglib/taglib/commit/dfa33bec0806cbb45785accb8cc6c2048a7d40cf]

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
 taglib/riff/rifffile.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/taglib/riff/rifffile.cpp b/taglib/riff/rifffile.cpp
index 005551f..f615e6c 100644
--- a/taglib/riff/rifffile.cpp
+++ b/taglib/riff/rifffile.cpp
@@ -361,6 +361,9 @@ void RIFF::File::writeChunk(const ByteVector &name, const ByteVector &data,
 
 void RIFF::File::updateGlobalSize()
 {
+  if(d->chunks.empty())
+    return;
+
   const Chunk first = d->chunks.front();
   const Chunk last  = d->chunks.back();
   d->size = last.offset + last.size + last.padding - first.offset + 12;
-- 
2.34.1

