@openclaw/matrix 2026.8.1-beta.2 → 2026.8.1

package/node_modules/music-metadata/lib/ParseError.d.ts

@@ -43,7 +43,7 @@ declare const UnexpectedFileContentError_base: {
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
 };
-declare class UnexpectedFileContentError extends UnexpectedFileContentError_base {
+export declare class UnexpectedFileContentError extends UnexpectedFileContentError_base {
     readonly fileType: string;
     constructor(fileType: string, message: string);
     toString(): string;

package/node_modules/music-metadata/lib/ParseError.js

@@ -13,7 +13,7 @@ export class CouldNotDetermineFileTypeError extends makeParseError('CouldNotDete
 export class UnsupportedFileTypeError extends makeParseError('UnsupportedFileTypeError') {
 }
 // Concrete error class representing unexpected file content.
-class UnexpectedFileContentError extends makeParseError('UnexpectedFileContentError') {
+export class UnexpectedFileContentError extends makeParseError('UnexpectedFileContentError') {
     constructor(fileType, message) {
         super(message);
         this.fileType = fileType;

package/node_modules/music-metadata/lib/asf/AsfObject.d.ts

@@ -81,9 +81,6 @@ export declare abstract class State<T> implements IGetToken<T> {
     abstract get(buf: Uint8Array, off: number): T;
     protected postProcessTag(tags: ITag[], name: string, valueType: number, data: AnyTagValue): void;
 }
-export declare class IgnoreObjectState extends State<unknown> {
-    get(_buf: Uint8Array, _off: number): null;
-}
 /**
  * Interface for: 3.2: File Properties Object (mandatory, one only)
  *
@@ -238,7 +235,7 @@ export interface ICodecEntry {
  * 3.5: Read the Codec-List-Object, which provides user-friendly information about the codecs and formats used to encode the content found in the ASF file.
  * Ref: http://drang.s4.xrea.com/program/tips/id3tag/wmp/03_asf_top_level_header_object.html#3_5
  */
-export declare function readCodecEntries(tokenizer: ITokenizer): Promise<ICodecEntry[]>;
+export declare function readCodecEntries(tokenizer: ITokenizer, payloadSize: number): Promise<ICodecEntry[]>;
 /**
  * 3.10 Content Description Object (optional, one only)
  * Ref: http://drang.s4.xrea.com/program/tips/id3tag/wmp/03_asf_top_level_header_object.html#3_10

package/node_modules/music-metadata/lib/asf/AsfObject.js

@@ -43,11 +43,14 @@ export const DataType = {
 export const TopLevelHeaderObjectToken = {
     len: 30,
     get: (buf, off) => {
+        const base = HeaderObjectToken.get(buf, off);
+        if (base.objectSize < TopLevelHeaderObjectToken.len) {
+            throw new AsfContentParseError(`Invalid ASF top-level header object size: ${base.objectSize}`);
+        }
         return {
-            objectId: AsfGuid.fromBin(buf, off),
-            objectSize: Number(Token.UINT64_LE.get(buf, off + 16)),
+            ...base,
             numberOfHeaderObjects: Token.UINT32_LE.get(buf, off + 24)
-            // Reserved: 2 bytes
+            // reserved: 2 bytes
         };
     }
 };
@@ -58,15 +61,20 @@ export const TopLevelHeaderObjectToken = {
 export const HeaderObjectToken = {
     len: 24,
     get: (buf, off) => {
-        return {
+        const objectSize = Token.UINT64_LE.get(buf, off + 16);
+        if (objectSize < BigInt(HeaderObjectToken.len) || objectSize > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new AsfContentParseError(`Invalid ASF header object size: ${objectSize}`);
+        }
+        const header = {
             objectId: AsfGuid.fromBin(buf, off),
-            objectSize: Number(Token.UINT64_LE.get(buf, off + 16))
+            objectSize: Number(objectSize)
         };
+        return header;
     }
 };
 export class State {
     constructor(header) {
-        this.len = Number(header.objectSize) - HeaderObjectToken.len;
+        this.len = header.objectSize - HeaderObjectToken.len;
     }
     postProcessTag(tags, name, valueType, data) {
         if (name === 'WM/Picture') {
@@ -81,12 +89,6 @@ export class State {
         }
     }
 }
-// ToDo: use ignore type
-export class IgnoreObjectState extends State {
-    get(_buf, _off) {
-        return null;
-    }
-}
 /**
  * Token for: 3.2: File Properties Object (mandatory, one only)
  * Ref: http://drang.s4.xrea.com/program/tips/id3tag/wmp/03_asf_top_level_header_object.html#3_2
@@ -140,7 +142,7 @@ export class HeaderExtensionObject {
         return {
             reserved1: AsfGuid.fromBin(buf, off),
             reserved2: view.getUint16(16, true),
-            extensionDataSize: view.getUint16(18, true)
+            extensionDataSize: view.getUint32(18, true)
         };
     }
 }
@@ -158,42 +160,76 @@ const CodecListObjectHeader = {
         };
     }
 };
-async function readString(tokenizer) {
-    const length = await tokenizer.readNumber(Token.UINT16_LE);
-    return (await tokenizer.readToken(new Token.StringType(length * 2, 'utf-16le'))).replace('\0', '');
+class BoundedReader {
+    constructor(tokenizer, size) {
+        this.tokenizer = tokenizer;
+        this.remaining = size;
+    }
+    async readToken(token) {
+        this.ensureAvailable(token.len);
+        const value = await this.tokenizer.readToken(token);
+        this.remaining -= token.len;
+        return value;
+    }
+    async readNumber(token) {
+        return this.readToken(token);
+    }
+    async readBuffer(length) {
+        this.ensureAvailable(length);
+        const buffer = new Uint8Array(length);
+        await this.tokenizer.readBuffer(buffer);
+        this.remaining -= length;
+        return buffer;
+    }
+    async ignoreRemaining() {
+        const ignored = await this.tokenizer.ignore(this.remaining);
+        if (ignored !== this.remaining) {
+            throw new AsfContentParseError(`Unexpected end of ASF Codec List Object; missing ${this.remaining - ignored} bytes`);
+        }
+        this.remaining = 0;
+    }
+    ensureAvailable(length) {
+        if (length > this.remaining) {
+            throw new AsfContentParseError(`ASF Codec List field size ${length} exceeds remaining object payload size ${this.remaining}`);
+        }
+    }
+}
+async function readString(reader) {
+    const length = await reader.readNumber(Token.UINT16_LE);
+    return (await reader.readToken(new Token.StringType(length * 2, 'utf-16le'))).replace('\0', '');
 }
 /**
  * 3.5: Read the Codec-List-Object, which provides user-friendly information about the codecs and formats used to encode the content found in the ASF file.
  * Ref: http://drang.s4.xrea.com/program/tips/id3tag/wmp/03_asf_top_level_header_object.html#3_5
  */
-export async function readCodecEntries(tokenizer) {
-    const codecHeader = await tokenizer.readToken(CodecListObjectHeader);
+export async function readCodecEntries(tokenizer, payloadSize) {
+    const reader = new BoundedReader(tokenizer, payloadSize);
+    const codecHeader = await reader.readToken(CodecListObjectHeader);
     const entries = [];
     for (let i = 0; i < codecHeader.entryCount; ++i) {
-        entries.push(await readCodecEntry(tokenizer));
+        entries.push(await readCodecEntry(reader));
     }
+    await reader.ignoreRemaining();
     return entries;
 }
-async function readInformation(tokenizer) {
-    const length = await tokenizer.readNumber(Token.UINT16_LE);
-    const buf = new Uint8Array(length);
-    await tokenizer.readBuffer(buf);
-    return buf;
+async function readInformation(reader) {
+    const length = await reader.readNumber(Token.UINT16_LE);
+    return reader.readBuffer(length);
 }
 /**
  * Read Codec-Entries
- * @param tokenizer
+ * @param reader
  */
-async function readCodecEntry(tokenizer) {
-    const type = await tokenizer.readNumber(Token.UINT16_LE);
+async function readCodecEntry(reader) {
+    const type = await reader.readNumber(Token.UINT16_LE);
     return {
         type: {
             videoCodec: (type & 0x0001) === 0x0001,
             audioCodec: (type & 0x0002) === 0x0002
         },
-        codecName: await readString(tokenizer),
-        description: await readString(tokenizer),
-        information: await readInformation(tokenizer)
+        codecName: await readString(reader),
+        description: await readString(reader),
+        information: await readInformation(reader)
     };
 }
 /**

package/node_modules/music-metadata/lib/asf/AsfParser.d.ts

@@ -11,7 +11,11 @@ import { BasicParser } from '../common/BasicParser.js';
  */
 export declare class AsfParser extends BasicParser {
     parse(): Promise<void>;
-    private parseObjectHeader;
+    private parseObjectHeaders;
     private addTags;
+    private readObjectHeader;
+    private validatePayloadAvailability;
+    private validateAllocationSize;
+    private ignorePayload;
     private parseExtensionObject;
 }

package/node_modules/music-metadata/lib/asf/AsfParser.js

@@ -1,4 +1,5 @@
 import initDebug from 'debug';
+import { EndOfStreamError } from 'strtok3';
 import { TrackType } from '../type.js';
 import AsfGuid from './AsfGuid.js';
 import * as AsfObject from './AsfObject.js';
@@ -6,6 +7,7 @@ import { BasicParser } from '../common/BasicParser.js';
 import { AsfContentParseError } from './AsfObject.js';
 const debug = initDebug('music-metadata:parser:ASF');
 const headerType = 'asf';
+const maxAsfMetadataObjectSize = 16 * 1024 * 1024;
 /**
  * Windows Media Metadata Usage Guidelines
  * - Ref: https://msdn.microsoft.com/en-us/library/ms867702.aspx
@@ -22,42 +24,64 @@ export class AsfParser extends BasicParser {
         if (!header.objectId.equals(AsfGuid.HeaderObject)) {
             throw new AsfContentParseError(`expected asf header; but was not found; got: ${header.objectId.str}`);
         }
-        await this.parseObjectHeader(header.numberOfHeaderObjects);
+        if (header.numberOfHeaderObjects < 1 || header.numberOfHeaderObjects > 10000) {
+            throw new AsfContentParseError(`Unrealistic number of ASF header objects: ${header.numberOfHeaderObjects}`);
+        }
+        await this.parseObjectHeaders(header.numberOfHeaderObjects, header.objectSize - AsfObject.TopLevelHeaderObjectToken.len);
     }
-    async parseObjectHeader(numberOfObjectHeaders) {
+    async parseObjectHeaders(numberOfObjectHeaders, remainingHeaderSize) {
         let tags;
-        do {
-            // Parse common header of the ASF Object (3.1)
-            const header = await this.tokenizer.readToken(AsfObject.HeaderObjectToken);
+        for (let index = 0; index < numberOfObjectHeaders; ++index) {
+            const { header, payloadSize } = await this.readObjectHeader(remainingHeaderSize, 'header');
             // Parse data part of the ASF Object
             debug('header GUID=%s', header.objectId.str);
             switch (header.objectId.str) {
                 case AsfObject.FilePropertiesObject.guid.str: { // 3.2
+                    this.validateAllocationSize(payloadSize, 'File Properties Object');
                     const fpo = await this.tokenizer.readToken(new AsfObject.FilePropertiesObject(header));
                     this.metadata.setFormat('duration', Number(fpo.playDuration / BigInt(1000)) / 10000 - Number(fpo.preroll) / 1000);
                     this.metadata.setFormat('bitrate', fpo.maximumBitrate);
                     break;
                 }
                 case AsfObject.StreamPropertiesObject.guid.str: { // 3.3
+                    this.validateAllocationSize(payloadSize, 'Stream Properties Object');
                     const spo = await this.tokenizer.readToken(new AsfObject.StreamPropertiesObject(header));
                     this.metadata.setFormat('container', `ASF/${spo.streamType}`);
                     break;
                 }
                 case AsfObject.HeaderExtensionObject.guid.str: { // 3.4
-                    const extHeader = await this.tokenizer.readToken(new AsfObject.HeaderExtensionObject());
+                    const extensionHeaderToken = new AsfObject.HeaderExtensionObject();
+                    if (payloadSize < extensionHeaderToken.len) {
+                        throw new AsfContentParseError(`ASF Header Extension Object payload is too small: ${payloadSize} bytes`);
+                    }
+                    const extHeader = await this.tokenizer.readToken(extensionHeaderToken);
+                    const expectedExtensionSize = payloadSize - extensionHeaderToken.len;
+                    if (extHeader.extensionDataSize !== expectedExtensionSize) {
+                        throw new AsfContentParseError(`ASF extension data size ${extHeader.extensionDataSize} does not match enclosing payload size ${expectedExtensionSize}`);
+                    }
                     await this.parseExtensionObject(extHeader.extensionDataSize);
                     break;
                 }
                 case AsfObject.ContentDescriptionObjectState.guid.str: // 3.10
+                    this.validateAllocationSize(payloadSize, 'Content Description Object');
                     tags = await this.tokenizer.readToken(new AsfObject.ContentDescriptionObjectState(header));
                     await this.addTags(tags);
                     break;
                 case AsfObject.ExtendedContentDescriptionObjectState.guid.str: // 3.11
+                    this.validateAllocationSize(payloadSize, 'Extended Content Description Object');
                     tags = await this.tokenizer.readToken(new AsfObject.ExtendedContentDescriptionObjectState(header));
                     await this.addTags(tags);
                     break;
                 case AsfGuid.CodecListObject.str: {
-                    const codecs = await AsfObject.readCodecEntries(this.tokenizer);
+                    this.validateAllocationSize(payloadSize, 'Codec List Object');
+                    let codecs;
+                    try {
+                        codecs = await AsfObject.readCodecEntries(this.tokenizer, payloadSize);
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        throw new AsfContentParseError(`Invalid ASF Codec List Object: ${message}`);
+                    }
                     codecs.forEach(codec => {
                         this.metadata.addStreamInfo({
                             type: codec.type.videoCodec ? TrackType.video : TrackType.audio,
@@ -70,65 +94,110 @@ export class AsfParser extends BasicParser {
                 }
                 case AsfGuid.StreamBitratePropertiesObject.str:
                     // ToDo?
-                    await this.tokenizer.ignore(header.objectSize - AsfObject.HeaderObjectToken.len);
+                    await this.ignorePayload(payloadSize, 'Stream Bitrate Properties Object');
                     break;
                 case AsfGuid.PaddingObject.str:
                     // ToDo: register bytes pad
-                    debug('Padding: %s bytes', header.objectSize - AsfObject.HeaderObjectToken.len);
-                    await this.tokenizer.ignore(header.objectSize - AsfObject.HeaderObjectToken.len);
+                    debug('Padding: %s bytes', payloadSize);
+                    await this.ignorePayload(payloadSize, 'Padding Object');
                     break;
                 default:
                     this.metadata.addWarning(`Ignore ASF-Object-GUID: ${header.objectId.str}`);
                     debug('Ignore ASF-Object-GUID: %s', header.objectId.str);
-                    await this.tokenizer.readToken(new AsfObject.IgnoreObjectState(header));
+                    await this.ignorePayload(payloadSize, `object ${header.objectId.str}`);
             }
-        } while (--numberOfObjectHeaders);
-        // done
+            remainingHeaderSize -= header.objectSize;
+        }
+        if (remainingHeaderSize !== 0) {
+            throw new AsfContentParseError(`ASF header child objects leave ${remainingHeaderSize} payload byte(s) unaccounted`);
+        }
     }
     async addTags(tags) {
         await Promise.all(tags.map(({ id, value }) => this.metadata.addTag(headerType, id, value)));
     }
-    async parseExtensionObject(extensionSize) {
-        do {
-            // Parse common header of the ASF Object (3.1)
-            const header = await this.tokenizer.readToken(AsfObject.HeaderObjectToken);
-            const remaining = header.objectSize - AsfObject.HeaderObjectToken.len;
-            if (remaining < 0) {
-                throw new AsfContentParseError(`Invalid ASF header object size: ${header.objectSize}`);
+    async readObjectHeader(remainingSize, containerType) {
+        if (remainingSize < AsfObject.HeaderObjectToken.len) {
+            throw new AsfContentParseError(`Insufficient ASF ${containerType} data for an object header: ${remainingSize} bytes`);
+        }
+        const header = await this.tokenizer.readToken(AsfObject.HeaderObjectToken);
+        if (header.objectSize > remainingSize) {
+            throw new AsfContentParseError(`ASF ${containerType} object size ${header.objectSize} exceeds remaining ${containerType} payload size ${remainingSize}`);
+        }
+        return {
+            header,
+            payloadSize: this.validatePayloadAvailability(header, `${containerType} object`)
+        };
+    }
+    validatePayloadAvailability(header, objectType) {
+        const payloadSize = header.objectSize - AsfObject.HeaderObjectToken.len;
+        const fileSize = this.tokenizer.fileInfo.size;
+        if (fileSize !== undefined) {
+            const available = fileSize - this.tokenizer.position;
+            if (payloadSize > available) {
+                throw new AsfContentParseError(`ASF ${objectType} payload size ${payloadSize} exceeds available input size ${available}`);
+            }
+        }
+        return payloadSize;
+    }
+    validateAllocationSize(payloadSize, objectType) {
+        if (payloadSize > maxAsfMetadataObjectSize) {
+            throw new AsfContentParseError(`ASF ${objectType} payload size ${payloadSize} exceeds allocation limit ${maxAsfMetadataObjectSize}`);
+        }
+    }
+    async ignorePayload(payloadSize, objectType) {
+        let ignored;
+        try {
+            ignored = await this.tokenizer.ignore(payloadSize);
+        }
+        catch (error) {
+            if (error instanceof EndOfStreamError) {
+                throw new AsfContentParseError(`Unexpected end of ASF ${objectType}`);
             }
+            throw error;
+        }
+        if (ignored !== payloadSize) {
+            throw new AsfContentParseError(`Unexpected end of ASF ${objectType}; missing ${payloadSize - ignored} bytes`);
+        }
+    }
+    async parseExtensionObject(extensionSize) {
+        while (extensionSize > 0) {
+            const { header, payloadSize } = await this.readObjectHeader(extensionSize, 'extension');
             // Parse data part of the ASF Object
             switch (header.objectId.str) {
                 case AsfObject.ExtendedStreamPropertiesObjectState.guid.str: // 4.1
                     // ToDo: extended stream header properties are ignored
+                    this.validateAllocationSize(payloadSize, 'Extended Stream Properties Object');
                     await this.tokenizer.readToken(new AsfObject.ExtendedStreamPropertiesObjectState(header));
                     break;
                 case AsfObject.MetadataObjectState.guid.str: { // 4.7
+                    this.validateAllocationSize(payloadSize, 'Metadata Object');
                     const moTags = await this.tokenizer.readToken(new AsfObject.MetadataObjectState(header));
                     await this.addTags(moTags);
                     break;
                 }
                 case AsfObject.MetadataLibraryObjectState.guid.str: { // 4.8
+                    this.validateAllocationSize(payloadSize, 'Metadata Library Object');
                     const mlTags = await this.tokenizer.readToken(new AsfObject.MetadataLibraryObjectState(header));
                     await this.addTags(mlTags);
                     break;
                 }
                 case AsfGuid.PaddingObject.str:
                     // ToDo: register bytes pad
-                    await this.tokenizer.ignore(remaining);
+                    await this.ignorePayload(payloadSize, 'extension Padding Object');
                     break;
                 case AsfGuid.CompatibilityObject.str:
-                    await this.tokenizer.ignore(remaining);
+                    await this.ignorePayload(payloadSize, 'Compatibility Object');
                     break;
                 case AsfGuid.ASF_Index_Placeholder_Object.str:
-                    await this.tokenizer.ignore(remaining);
+                    await this.ignorePayload(payloadSize, 'Index Placeholder Object');
                     break;
                 default:
                     this.metadata.addWarning(`Ignore ASF-Object-GUID: ${header.objectId.str}`);
                     // console.log("Ignore ASF-Object-GUID: %s", header.objectId.str);
-                    await this.tokenizer.readToken(new AsfObject.IgnoreObjectState(header));
+                    await this.ignorePayload(payloadSize, `extension object ${header.objectId.str}`);
                     break;
             }
             extensionSize -= header.objectSize;
-        } while (extensionSize > 0);
+        }
     }
 }

package/node_modules/music-metadata/lib/dsf/DsfChunk.js

@@ -16,8 +16,8 @@ export const DsdChunk = {
     len: 16,
     get: (buf, off) => {
         return {
-            fileSize: Token.INT64_LE.get(buf, off),
-            metadataPointer: Token.INT64_LE.get(buf, off + 8)
+            fileSize: Token.UINT64_LE.get(buf, off),
+            metadataPointer: Token.UINT64_LE.get(buf, off + 8)
         };
     }
 };

package/node_modules/music-metadata/lib/dsf/DsfParser.js

@@ -1,8 +1,9 @@
 import initDebug from 'debug';
 import { AbstractID3Parser } from '../id3v2/AbstractID3Parser.js';
 import { ChunkHeader, DsdChunk, FormatChunk } from './DsfChunk.js';
-import { ID3v2Parser } from "../id3v2/ID3v2Parser.js";
+import { ID3v2Parser } from '../id3v2/ID3v2Parser.js';
 import { makeUnexpectedFileContentError } from '../ParseError.js';
+import { ID3v2Header } from '../id3v2/ID3v2Token.js';
 const debug = initDebug('music-metadata:parser:DSF');
 export class DsdContentParseError extends makeUnexpectedFileContentError('DSD') {
 }
@@ -14,41 +15,65 @@ export class DsfParser extends AbstractID3Parser {
     async postId3v2Parse() {
         const p0 = this.tokenizer.position; // mark start position, normally 0
         const chunkHeader = await this.tokenizer.readToken(ChunkHeader);
-        if (chunkHeader.id !== 'DSD ')
+        if (chunkHeader.id !== 'DSD ') {
             throw new DsdContentParseError('Invalid chunk signature');
+        }
+        if (chunkHeader.size !== BigInt(ChunkHeader.len + DsdChunk.len)) {
+            throw new DsdContentParseError(`Invalid DSD chunk size: ${chunkHeader.size}`);
+        }
         this.metadata.setFormat('container', 'DSF');
         this.metadata.setFormat('lossless', true);
         this.metadata.setAudioOnly();
         const dsdChunk = await this.tokenizer.readToken(DsdChunk);
-        if (dsdChunk.metadataPointer === BigInt(0)) {
-            debug("No ID3v2 tag present");
+        if (dsdChunk.fileSize < chunkHeader.size) {
+            throw new DsdContentParseError(`Invalid DSF file size: ${dsdChunk.fileSize}`);
+        }
+        await this.parseChunks(dsdChunk.fileSize - chunkHeader.size);
+        if (dsdChunk.metadataPointer === 0n) {
+            debug('No ID3v2 tag present');
+            return;
         }
-        else {
-            debug(`expect ID3v2 at offset=${dsdChunk.metadataPointer}`);
-            await this.parseChunks(dsdChunk.fileSize - chunkHeader.size);
-            // Jump to ID3 header
-            await this.tokenizer.ignore(Number(dsdChunk.metadataPointer) - this.tokenizer.position - p0);
-            return new ID3v2Parser().parse(this.metadata, this.tokenizer, this.options);
+        debug(`expect ID3v2 at offset=${dsdChunk.metadataPointer}`);
+        const metadataOffset = dsdChunk.metadataPointer - BigInt(this.tokenizer.position - p0);
+        if (metadataOffset < 0n ||
+            metadataOffset > BigInt(Number.MAX_SAFE_INTEGER) ||
+            dsdChunk.metadataPointer + BigInt(ID3v2Header.len) > dsdChunk.fileSize) {
+            throw new DsdContentParseError(`Invalid metadata pointer: ${dsdChunk.metadataPointer}`);
         }
+        await this.tokenizer.ignore(Number(metadataOffset));
+        return new ID3v2Parser().parse(this.metadata, this.tokenizer, this.options);
     }
     async parseChunks(bytesRemaining) {
-        while (bytesRemaining >= ChunkHeader.len) {
+        const chunkHeaderSize = BigInt(ChunkHeader.len);
+        while (bytesRemaining >= chunkHeaderSize) {
             const chunkHeader = await this.tokenizer.readToken(ChunkHeader);
             debug(`Parsing chunk name=${chunkHeader.id} size=${chunkHeader.size}`);
+            if (chunkHeader.size < chunkHeaderSize) {
+                throw new DsdContentParseError(`Invalid ${chunkHeader.id} chunk size: ${chunkHeader.size}`);
+            }
+            if (chunkHeader.size > bytesRemaining) {
+                throw new DsdContentParseError(`${chunkHeader.id} chunk exceeds remaining file size`);
+            }
+            const payloadSize = chunkHeader.size - chunkHeaderSize;
             switch (chunkHeader.id) {
                 case 'fmt ': {
+                    if (payloadSize < BigInt(FormatChunk.len)) {
+                        throw new DsdContentParseError(`Invalid fmt chunk size: ${chunkHeader.size}`);
+                    }
                     const formatChunk = await this.tokenizer.readToken(FormatChunk);
                     this.metadata.setFormat('numberOfChannels', formatChunk.channelNum);
                     this.metadata.setFormat('sampleRate', formatChunk.samplingFrequency);
                     this.metadata.setFormat('bitsPerSample', formatChunk.bitsPerSample);
                     this.metadata.setFormat('numberOfSamples', formatChunk.sampleCount);
                     this.metadata.setFormat('duration', Number(formatChunk.sampleCount) / formatChunk.samplingFrequency);
-                    const bitrate = formatChunk.bitsPerSample * formatChunk.samplingFrequency * formatChunk.channelNum;
+                    const bitrate = formatChunk.bitsPerSample *
+                        formatChunk.samplingFrequency *
+                        formatChunk.channelNum;
                     this.metadata.setFormat('bitrate', bitrate);
                     return; // We got what we want, stop further processing of chunks
                 }
                 default:
-                    this.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len);
+                    await this.tokenizer.ignore(Number(payloadSize));
                     break;
             }
             bytesRemaining -= chunkHeader.size;

package/node_modules/music-metadata/lib/mp4/AtomToken.js

@@ -313,7 +313,8 @@ export class StsdAtom {
             const size = Token.UINT32_BE.get(buf, off); // Sample description size
             off += Token.UINT32_BE.len;
             table.push(new SampleDescriptionTable(size - Token.UINT32_BE.len).get(buf, off));
-            off += size;
+            // A SampleEntry extends Box, so its size covers the size field already stepped over
+            off += size - Token.UINT32_BE.len;
         }
         return {
             header,

package/node_modules/music-metadata/lib/mp4/MP4Parser.js

@@ -72,6 +72,26 @@ const encoderDict = {
 function distinct(value, index, self) {
     return self.indexOf(value) === index;
 }
+/**
+ * Determine if a track carries audio.
+ *
+ * Ref: ISO/IEC 14496-12, 8.5.2: the sample entries in a sample description box are track-type specific,
+ * selected by the handler type of the enclosing track. Only an audio track holds an AudioSampleEntry, so
+ * only such a track may be described by a sound sample description; `isAudio()` treats both the 'soun'
+ * and 'audi' handler types as audio.
+ *
+ * Falls back to the sample description when no handler box was found, preserving the previous behavior.
+ */
+function isAudioTrack(track) {
+    const [ssd] = track.soundSampleDescription ?? [];
+    if (!ssd) {
+        return false;
+    }
+    if (track.isAudio) {
+        return track.isAudio();
+    }
+    return !!ssd.description && ssd.description.numAudioChannels > 0;
+}
 /*
  * Parser for the MP4 (MPEG-4 Part 14) container format
  * Standard: ISO/IEC 14496-14
@@ -209,6 +229,7 @@ export class MP4Parser extends BasicParser {
         const formatList = [];
         this.tracks.forEach(track => {
             const trackFormats = [];
+            const trackIsAudio = isAudioTrack(track);
             track.soundSampleDescription.forEach(ssd => {
                 const streamInfo = {};
                 const encoderInfo = encoderDict[ssd.dataFormat];
@@ -219,7 +240,7 @@ export class MP4Parser extends BasicParser {
                 else {
                     streamInfo.codecName = `<${ssd.dataFormat}>`;
                 }
-                if (ssd.description) {
+                if (trackIsAudio && ssd.description) {
                     const { description } = ssd;
                     if (description.sampleRate > 0) {
                         streamInfo.type = TrackType.audio;
@@ -239,9 +260,7 @@ export class MP4Parser extends BasicParser {
         if (formatList.length > 0) {
             this.metadata.setFormat('codec', formatList.filter(distinct).join('+'));
         }
-        const audioTracks = [...this.tracks.values()].filter(track => {
-            return track.soundSampleDescription.length >= 1 && track.soundSampleDescription[0].description && track.soundSampleDescription[0].description.numAudioChannels > 0;
-        });
+        const audioTracks = [...this.tracks.values()].filter(isAudioTrack);
         // Calculate duration and bitrate of audio tracks
         for (const audioTrack of audioTracks) {
             if (audioTrack.media.header && audioTrack.media.header.timeScale > 0) {
@@ -561,12 +580,20 @@ export class MP4Parser extends BasicParser {
             dataReferenceIndex: sampleDescription.dataReferenceIndex
         };
         let offset = 0;
-        if (sampleDescription.description) {
-            const version = AtomToken.SoundSampleDescriptionVersion.get(sampleDescription.description, offset);
+        const { description } = sampleDescription;
+        // Only an AudioSampleEntry carries a sound sample description; it is at least 20 bytes beyond the
+        // 16-byte SampleEntry base. A shorter description belongs to another sample entry class, or is truncated.
+        if (description && description.length >= AtomToken.SoundSampleDescriptionVersion.len) {
+            const version = AtomToken.SoundSampleDescriptionVersion.get(description, offset);
             offset += AtomToken.SoundSampleDescriptionVersion.len;
             if (version.version === 0 || version.version === 1) {
                 // Sound Sample Description (Version 0)
-                ssd.description = AtomToken.SoundSampleDescriptionV0.get(sampleDescription.description, offset);
+                if (description.length >= offset + AtomToken.SoundSampleDescriptionV0.len) {
+                    ssd.description = AtomToken.SoundSampleDescriptionV0.get(description, offset);
+                }
+                else {
+                    debug(`Warning: sound-sample-description too short: ${description.length} bytes`);
+                }
             }
             else {
                 debug(`Warning: sound-sample-description ${version} not implemented`);

package/node_modules/music-metadata/lib/ogg/speex/SpeexStream.d.ts

@@ -10,6 +10,7 @@ import type { INativeMetadataCollector } from '../../common/MetadataCollector.js
  * - https://tools.ietf.org/html/rfc5574
  */
 export declare class SpeexStream extends VorbisStream {
+    private commentHeaderParsed;
     constructor(metadata: INativeMetadataCollector, options: IOptions, _tokenizer: ITokenizer);
     /**
      * Parse first Speex Ogg page
@@ -17,4 +18,10 @@ export declare class SpeexStream extends VorbisStream {
      * @param {Uint8Array} pageData
      */
     protected parseFirstPage(_header: IPageHeader, pageData: Uint8Array): void;
+    /**
+     * The packet following the identification header is the comment header, in
+     * Vorbis comment format but without a packet type or magic signature.
+     * Ref: https://tools.ietf.org/html/rfc5574#section-3
+     */
+    protected parseFullPage(pageData: Uint8Array): Promise<void>;
 }