mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-27 19:36:56 -06:00
Root cause: parse_entries sets the cursor to start + len after each Anno entry. An entry length below 8 (its own u32 plus the type) left the cursor on the same entry, so a count of 0xFFFFFFFF re-read it about 4.3e9 times, pushing an entry each time until allocation failed and the process aborted (not a panic, so the import guard could not catch it). Fix: reject an entry length below 8, so the block is reported unreadable and kept verbatim (the #944 behaviour); every entry now advances at least 8 bytes. Regression test covers lengths 0/4/7 for sndA and txtA entries plus the hostile 16-byte block. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>