Borewit / music-metadata / 32131341923

96%

push

github

Fix DSF parsing of malformed chunk sizes.

The DSF parser skipped unknown chunk payloads using an un-awaited tokenizer.ignore() call. When a malformed chunk declared a size smaller than the chunk header, this resulted in a negative skip length. strtok3 rejects such calls, and because the promise was not awaited, the rejection could escape the parser promise chain and terminate the Node.js process as an unhandled rejection.

Changes:
- Await tokenizer.ignore() when skipping unknown DSF chunks.
- Validate chunk sizes before processing or skipping their payload.
- Reject chunks that exceed the remaining DSF data.
- Validate the minimum size of the fmt chunk.
- Validate the DSF metadata pointer before seeking to the ID3v2 tag.
- Parse the fmt chunk independently of the presence of an ID3v2 tag.

1625 of 1837 branches covered (88.46%)

Branch coverage included in aggregate %.

8700 of 8966 relevant lines covered (97.03%)

54910.14 hits per line