@openclaw/whatsapp 2026.9.34 → 2026.9.36

package/node_modules/baileys/node_modules/music-metadata/lib/id3v2/ID3v2Parser.js

@@ -1,7 +1,7 @@
 import * as Token from 'token-types';
+import { getFrameHeaderLength, readFrameHeader } from './FrameHeader.js';
 import { FrameParser, Id3v2ContentError } from './FrameParser.js';
 import { ExtendedHeader, ID3v2Header } from './ID3v2Token.js';
-import { getFrameHeaderLength, readFrameHeader } from './FrameHeader.js';
 export class ID3v2Parser {
     constructor() {
         this.tokenizer = undefined;
@@ -17,7 +17,7 @@ export class ID3v2Parser {
             if (readI !== writeI) {
                 buffer[writeI] = buffer[readI];
             }
-            readI += (buffer[readI] === 0xFF && buffer[readI + 1] === 0) ? 2 : 1;
+            readI += buffer[readI] === 0xff && buffer[readI + 1] === 0 ? 2 : 1;
             writeI++;
         }
         if (readI < buffer.length) {
@@ -58,10 +58,17 @@ export class ID3v2Parser {
         this.options = options;
         const id3Header = await this.tokenizer.readToken(ID3v2Header);
         if (id3Header.fileIdentifier !== 'ID3') {
-            throw new Id3v2ContentError('expected ID3-header file-identifier \'ID3\' was not found');
+            throw new Id3v2ContentError("expected ID3-header file-identifier 'ID3' was not found");
+        }
+        const fileSize = this.tokenizer.fileInfo.size;
+        if (fileSize !== undefined) {
+            const remainingBytes = fileSize - this.tokenizer.position;
+            if (id3Header.size > remainingBytes) {
+                throw new Id3v2ContentError(`ID3v2 tag size ${id3Header.size} exceeds remaining file size ${remainingBytes}`);
+            }
         }
         this.id3Header = id3Header;
-        this.headerType = (`ID3v2.${id3Header.version.major}`);
+        this.headerType = `ID3v2.${id3Header.version.major}`;
         await (id3Header.flags.isExtendedHeader ? this.parseExtendedHeader() : this.parseId3Data(id3Header.size));
         // Post process
         const chapters = ID3v2Parser.mapId3v2Chapters(this.metadata.native[this.headerType]);
@@ -70,7 +77,9 @@ export class ID3v2Parser {
     async parseExtendedHeader() {
         const extendedHeader = await this.tokenizer.readToken(ExtendedHeader);
         const dataRemaining = extendedHeader.size - ExtendedHeader.len;
-        return dataRemaining > 0 ? this.parseExtendedHeaderData(dataRemaining, extendedHeader.size) : this.parseId3Data(this.id3Header.size - extendedHeader.size);
+        return dataRemaining > 0
+            ? this.parseExtendedHeaderData(dataRemaining, extendedHeader.size)
+            : this.parseId3Data(this.id3Header.size - extendedHeader.size);
     }
     async parseExtendedHeaderData(dataRemaining, extendedHeaderSize) {
         await this.tokenizer.ignore(dataRemaining);
@@ -86,7 +95,9 @@ export class ID3v2Parser {
                     }
                     break;
                 default:
-                    await (Array.isArray(tag.value) ? Promise.all(tag.value.map(value => this.addTag(tag.id, value))) : this.addTag(tag.id, tag.value));
+                    await (Array.isArray(tag.value)
+                        ? Promise.all(tag.value.map(value => this.addTag(tag.id, value)))
+                        : this.addTag(tag.id, tag.value));
             }
         }
     }
@@ -100,8 +111,9 @@ export class ID3v2Parser {
         let offset = 0;
         const tags = [];
         while (true) {
-            if (offset === data.length)
+            if (offset === data.length) {
                 break;
+            }
             const frameHeaderLength = getFrameHeaderLength(this.id3Header.version.major);
             if (offset + frameHeaderLength > data.length) {
                 this.metadata.addWarning('Illegal ID3v2 tag length');
@@ -126,28 +138,32 @@ export class ID3v2Parser {
      * as produced by `FrameParser.readData`.
      */
     static mapId3v2Chapters(id3Tags) {
-        if (!id3Tags)
+        if (!id3Tags) {
             return;
-        const chapFrames = id3Tags.filter(t => t.id === 'CHAP');
-        if (!chapFrames?.length)
+        }
+        const chapFrames = id3Tags.filter(t => t.id === 'CHAP').map(t => t.value);
+        if (!chapFrames.length) {
             return;
-        const tocFrames = id3Tags.filter(t => t.id === 'CTOC');
-        const topLevelToc = tocFrames?.find(t => t.value.flags?.topLevel);
+        }
+        const tocFrames = id3Tags.filter(t => t.id === 'CTOC').map(t => t.value);
+        const topLevelToc = tocFrames.find(t => t.flags.topLevel);
         const chapterById = new Map();
         for (const chap of chapFrames) {
-            chapterById.set(chap.value.label, chap.value);
+            chapterById.set(chap.label, chap);
         }
-        const orderedIds = topLevelToc?.value.childElementIds;
+        const orderedIds = topLevelToc?.childElementIds;
         const chapters = [];
         const source = orderedIds ?? [...chapterById.keys()];
         for (const id of source) {
             const chap = chapterById.get(id);
-            if (!chap)
+            if (!chap) {
                 continue;
+            }
             const frames = chap.frames;
             const title = frames.get('TIT2');
-            if (!title)
+            if (!title) {
                 continue; // title is required
+            }
             chapters.push({
                 id,
                 title,

package/node_modules/baileys/node_modules/music-metadata/lib/id3v2/ID3v2Token.d.ts

@@ -46,13 +46,13 @@ export declare const LyricsContentType: {
     chord: number;
     trivia_pop: number;
 };
-export type LyricsContentType = typeof LyricsContentType[keyof typeof LyricsContentType];
+export type LyricsContentType = (typeof LyricsContentType)[keyof typeof LyricsContentType];
 export declare const TimestampFormat: {
     notSynchronized: number;
     mpegFrameNumber: number;
     milliseconds: number;
 };
-export type TimestampFormat = typeof TimestampFormat[keyof typeof TimestampFormat];
+export type TimestampFormat = (typeof TimestampFormat)[keyof typeof TimestampFormat];
 /**
  * 28 bits (representing up to 256MB) integer, the msb is 0 to avoid 'false syncsignals'.
  * 4 * %0xxxxxxx

package/node_modules/baileys/node_modules/music-metadata/lib/id3v2/ID3v2Token.js

@@ -37,7 +37,7 @@ export const LyricsContentType = {
     movement_part: 3,
     events: 4,
     chord: 5,
-    trivia_pop: 6,
+    trivia_pop: 6
 };
 export const TimestampFormat = {
     notSynchronized: 0,
@@ -50,8 +50,7 @@ export const TimestampFormat = {
  */
 export const UINT32SYNCSAFE = {
     get: (buf, off) => {
-        return buf[off + 3] & 0x7f | ((buf[off + 2]) << 7) |
-            ((buf[off + 1]) << 14) | ((buf[off]) << 21);
+        return (buf[off + 3] & 0x7f) | (buf[off + 2] << 7) | (buf[off + 1] << 14) | (buf[off] << 21);
     },
     len: 4
 };

package/node_modules/baileys/node_modules/music-metadata/lib/index.js

@@ -1,8 +1,8 @@
 /**
  * Node.js specific entry point.
  */
-import { fromFile, fromStream } from 'strtok3';
 import initDebug from 'debug';
+import { fromFile, fromStream } from 'strtok3';
 import { CouldNotDetermineFileTypeError, parseFromTokenizer, UnsupportedFileTypeError } from './core.js';
 import { ParserFactory } from './ParserFactory.js';
 export * from './core.js';
@@ -15,7 +15,9 @@ const debug = initDebug('music-metadata:parser');
  * @returns Metadata
  */
 export async function parseStream(stream, fileInfo, options = {}) {
-    const tokenizer = await fromStream(stream, { fileInfo: typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo });
+    const tokenizer = await fromStream(stream, {
+        fileInfo: typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo
+    });
     try {
         return await parseFromTokenizer(tokenizer, options);
     }
@@ -35,8 +37,9 @@ export async function parseFile(filePath, options = {}) {
     const parserFactory = new ParserFactory();
     try {
         const parserLoader = parserFactory.findLoaderForExtension(filePath);
-        if (!parserLoader)
+        if (!parserLoader) {
             debug('Parser could not be determined by file extension');
+        }
         try {
             return await parserFactory.parse(fileTokenizer, parserLoader, options);
         }

package/node_modules/baileys/node_modules/music-metadata/lib/lrc/LyricsParser.js

@@ -12,7 +12,7 @@ export function toUnsyncedLyrics(lyrics) {
         contentType: LyricsContentType.lyrics,
         timeStampFormat: TimestampFormat.notSynchronized,
         text: lyrics.trim(),
-        syncText: [],
+        syncText: []
     };
 }
 /**
@@ -28,9 +28,7 @@ export function parseLrc(lrcString) {
         if (match) {
             const minutes = Number.parseInt(match[1], 10);
             const seconds = Number.parseInt(match[2], 10);
-            const ms = match[3].length === 3
-                ? Number.parseInt(match[3], 10)
-                : Number.parseInt(match[3], 10) * 10;
+            const ms = match[3].length === 3 ? Number.parseInt(match[3], 10) : Number.parseInt(match[3], 10) * 10;
             const timestamp = (minutes * 60 + seconds) * 1000 + ms;
             const text = line.replace(TIMESTAMP_REGEX, '').trim();
             syncText.push({ timestamp, text });
@@ -40,6 +38,6 @@ export function parseLrc(lrcString) {
         contentType: LyricsContentType.lyrics,
         timeStampFormat: TimestampFormat.milliseconds,
         text: syncText.map(line => line.text).join('\n'),
-        syncText,
+        syncText
     };
 }

package/node_modules/baileys/node_modules/music-metadata/lib/matroska/MatroskaDtd.js

@@ -9,6 +9,7 @@ export const matroskaDtd = {
     name: 'dtd',
     container: {
         0x1a45dfa3: {
+            // 5.1
             name: 'ebml',
             container: {
                 0x4286: { name: 'ebmlVersion', value: DataType.uint }, // 5.1.1
@@ -178,7 +179,8 @@ export const matroskaDtd = {
                                         0x5378: { name: 'blockNumber', value: DataType.uint },
                                         0xea: { name: 'codecState', value: DataType.uint },
                                         0xdb: {
-                                            name: 'reference', container: {
+                                            name: 'reference',
+                                            container: {
                                                 0x96: { name: 'time', value: DataType.uint },
                                                 0x97: { name: 'cluster', value: DataType.uint },
                                                 0x535f: { name: 'number', value: DataType.uint },
@@ -225,10 +227,12 @@ export const matroskaDtd = {
                                         0x98: { name: 'hidden', value: DataType.bool },
                                         0x4598: { name: 'enabled', value: DataType.uid },
                                         0x8f: {
-                                            name: 'track', container: {
+                                            name: 'track',
+                                            container: {
                                                 0x89: { name: 'trackNumber', value: DataType.uid },
                                                 0x80: {
-                                                    name: 'display', container: {
+                                                    name: 'display',
+                                                    container: {
                                                         0x85: { name: 'string', value: DataType.string },
                                                         0x437c: { name: 'language ', value: DataType.string },
                                                         0x437e: { name: 'country ', value: DataType.string }

package/node_modules/baileys/node_modules/music-metadata/lib/matroska/MatroskaParser.js

@@ -1,8 +1,8 @@
 import initDebug from 'debug';
 import { BasicParser } from '../common/BasicParser.js';
+import { EbmlIterator, ParseAction } from '../ebml/EbmlIterator.js';
 import { matroskaDtd } from './MatroskaDtd.js';
 import { TargetType, TrackType } from './types.js';
-import { EbmlIterator, ParseAction } from '../ebml/EbmlIterator.js';
 const debug = initDebug('music-metadata:parser:matroska');
 /**
  * Extensible Binary Meta Language (EBML) parser
@@ -26,7 +26,7 @@ export class MatroskaParser extends BasicParser {
         const matroskaIterator = new EbmlIterator(this.tokenizer);
         debug('Initializing DTD end MatroskaIterator');
         await matroskaIterator.iterate(matroskaDtd, containerSize, {
-            startNext: (element) => {
+            startNext: element => {
                 switch (element.id) {
                     // case 0x1f43b675: // cluster
                     case 0x1c53bb6b: // Cueing Data
@@ -59,18 +59,20 @@ export class MatroskaParser extends BasicParser {
                         this.seekHeadOffset = offset;
                         break;
                     case 0x1549a966:
-                        { // Info (Segment Information)
+                        {
+                            // Info (Segment Information)
                             const info = value;
                             const timecodeScale = info.timecodeScale ? info.timecodeScale : 1000000;
                             if (typeof info.duration === 'number') {
-                                const duration = info.duration * timecodeScale / 1000000000;
+                                const duration = (info.duration * timecodeScale) / 1000000000;
                                 await this.addTag('segment:title', info.title);
                                 this.metadata.setFormat('duration', Number(duration));
                             }
                         }
                         break;
                     case 0x1654ae6b:
-                        { // tracks
+                        {
+                            // tracks
                             const audioTracks = value;
                             if (audioTracks?.entries) {
                                 audioTracks.entries.forEach(entry => {
@@ -91,12 +93,15 @@ export class MatroskaParser extends BasicParser {
                                 const audioTrack = audioTracks.entries
                                     .filter(entry => entry.trackType === TrackType.audio)
                                     .reduce((acc, cur) => {
-                                    if (!acc)
+                                    if (!acc) {
                                         return cur;
-                                    if (cur.flagDefault && !acc.flagDefault)
+                                    }
+                                    if (cur.flagDefault && !acc.flagDefault) {
                                         return cur;
-                                    if (cur.trackNumber < acc.trackNumber)
+                                    }
+                                    if (cur.trackNumber < acc.trackNumber) {
                                         return cur;
+                                    }
                                     return acc;
                                 }, null);
                                 if (audioTrack) {
@@ -108,11 +113,16 @@ export class MatroskaParser extends BasicParser {
                         }
                         break;
                     case 0x1254c367:
-                        { // tags
+                        {
+                            // tags
                             const tags = value;
                             await Promise.all(tags.tag.map(async (tag) => {
                                 const target = tag.target;
-                                const targetType = target?.targetTypeValue ? TargetType[target.targetTypeValue] : (target?.targetType ? target.targetType : 'track');
+                                const targetType = target?.targetTypeValue
+                                    ? TargetType[target.targetTypeValue]
+                                    : target?.targetType
+                                        ? target.targetType
+                                        : 'track';
                                 await Promise.all(tag.simpleTags.map(async (simpleTag) => {
                                     const value = simpleTag.string ? simpleTag.string : simpleTag.binary;
                                     await this.addTag(`${targetType}:${simpleTag.name}`, value);
@@ -121,7 +131,8 @@ export class MatroskaParser extends BasicParser {
                         }
                         break;
                     case 0x1941a469:
-                        { // attachments
+                        {
+                            // attachments
                             const attachments = value;
                             await Promise.all(attachments.attachedFiles
                                 .filter(file => file.mimeType.startsWith('image/'))

package/node_modules/baileys/node_modules/music-metadata/lib/matroska/types.d.ts

@@ -75,7 +75,7 @@ export interface ICueReference {
 }
 export interface ISimpleTag {
     name?: string;
-    'string'?: string;
+    string?: string;
     binary?: Uint8Array;
     language?: string;
     default?: boolean;
@@ -98,7 +98,7 @@ export declare const TrackType: {
     button: number;
     control: number;
 };
-export type TrackType = typeof TrackType[keyof typeof TrackType];
+export type TrackType = (typeof TrackType)[keyof typeof TrackType];
 export type TrackTypeKey = keyof typeof TrackType;
 export declare const TrackTypeValueToKeyMap: Record<TrackType, TrackTypeKey>;
 export interface ITarget {

package/node_modules/baileys/node_modules/music-metadata/lib/mp4/Atom.d.ts

@@ -1,16 +1,17 @@
-import * as AtomToken from './AtomToken.js';
 import type { ITokenizer } from 'strtok3';
+import * as AtomToken from './AtomToken.js';
 export type AtomDataHandler = (atom: Atom, remaining: number) => Promise<void>;
 export declare class Atom {
+    private readonly payloadLength;
     static readAtom(tokenizer: ITokenizer, dataHandler: AtomDataHandler, parent: Atom | null, remaining: number): Promise<Atom>;
     readonly children: Atom[];
     readonly atomPath: string;
     readonly header: AtomToken.IAtomHeader;
     extended: boolean;
     readonly parent: Atom | null;
-    constructor(header: AtomToken.IAtomHeader, extended: boolean, parent: Atom | null);
+    constructor(header: AtomToken.IAtomHeader, extended: boolean, parent: Atom | null, payloadLength: number);
     getHeaderLength(): number;
-    getPayloadLength(remaining: number): number;
+    getPayloadLength(): number;
     readAtoms(tokenizer: ITokenizer, dataHandler: AtomDataHandler, size: number): Promise<void>;
     private readData;
 }

package/node_modules/baileys/node_modules/music-metadata/lib/mp4/Atom.js

@@ -1,24 +1,43 @@
 import initDebug from 'debug';
 import * as AtomToken from './AtomToken.js';
-import { Header } from './AtomToken.js';
+import { Header, Mp4ContentError } from './AtomToken.js';
 const debug = initDebug('music-metadata:parser:MP4:Atom');
 export class Atom {
     static async readAtom(tokenizer, dataHandler, parent, remaining) {
-        // Parse atom header
+        // Validate boundaries before reading either header or dispatching a payload parser.
         const offset = tokenizer.position;
+        remaining = Math.min(remaining, (tokenizer.fileInfo.size ?? Number.POSITIVE_INFINITY) - offset);
+        if (remaining < AtomToken.Header.len) {
+            throw new Mp4ContentError('Truncated atom header');
+        }
         debug(`Reading next token on offset=${offset}...`); //  buf.toString('ascii')
         const header = await tokenizer.readToken(AtomToken.Header);
         const extended = header.length === 1n;
         if (extended) {
+            if (remaining < 16) {
+                throw new Mp4ContentError('Truncated extended atom header');
+            }
             header.length = await tokenizer.readToken(AtomToken.ExtendedSize);
         }
-        const atomBean = new Atom(header, extended, parent);
-        const payloadLength = atomBean.getPayloadLength(remaining);
+        const headerLength = extended ? 16 : 8;
+        if ((extended || header.length !== 0n) && header.length < BigInt(headerLength)) {
+            throw new Mp4ContentError(`Invalid atom size: ${header.length}`);
+        }
+        if (header.length > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new Mp4ContentError(`Atom size exceeds Number.MAX_SAFE_INTEGER: ${header.length}`);
+        }
+        const length = header.length === 0n ? remaining : Number(header.length);
+        if (length > remaining) {
+            throw new Mp4ContentError(`Atom size exceeds remaining bytes: ${header.length} > ${remaining}`);
+        }
+        const payloadLength = length - headerLength;
+        const atomBean = new Atom(header, extended, parent, payloadLength);
         debug(`parse atom name=${atomBean.atomPath}, extended=${atomBean.extended}, offset=${offset}, len=${atomBean.header.length}`); //  buf.toString('ascii')
         await atomBean.readData(tokenizer, dataHandler, payloadLength);
         return atomBean;
     }
-    constructor(header, extended, parent) {
+    constructor(header, extended, parent, payloadLength) {
+        this.payloadLength = payloadLength;
         this.header = header;
         this.extended = extended;
         this.parent = parent;
@@ -28,14 +47,24 @@ export class Atom {
     getHeaderLength() {
         return this.extended ? 16 : 8;
     }
-    getPayloadLength(remaining) {
-        return (this.header.length === 0n ? remaining : Number(this.header.length)) - this.getHeaderLength();
+    getPayloadLength() {
+        return this.payloadLength;
     }
     async readAtoms(tokenizer, dataHandler, size) {
         while (size > 0) {
+            if (size === Number.POSITIVE_INFINITY) {
+                // An open-ended container ends only at clean EOF, before the next header.
+                const bytesRead = await tokenizer.peekBuffer(new Uint8Array(Header.len), { mayBeLess: true });
+                if (bytesRead === 0) {
+                    return;
+                }
+                if (bytesRead < Header.len) {
+                    throw new Mp4ContentError('Truncated atom header');
+                }
+            }
             const atomBean = await Atom.readAtom(tokenizer, dataHandler, this, size);
             this.children.push(atomBean);
-            size -= atomBean.header.length === 0n ? size : Number(atomBean.header.length);
+            size = atomBean.header.length === 0n ? 0 : size - Number(atomBean.header.length);
         }
     }
     async readData(tokenizer, dataHandler, remaining) {
@@ -50,13 +79,17 @@ export class Atom {
             case 'ilst':
             case 'tref':
             case 'moof':
-                return this.readAtoms(tokenizer, dataHandler, this.getPayloadLength(remaining));
-            case 'meta': { // Metadata Atom, ref: https://developer.apple.com/library/content/documentation/QuickTime/QTFF/Metadata/Metadata.html#//apple_ref/doc/uid/TP40000939-CH1-SW8
+                return this.readAtoms(tokenizer, dataHandler, remaining);
+            case 'meta': {
+                // Metadata Atom, ref: https://developer.apple.com/library/content/documentation/QuickTime/QTFF/Metadata/Metadata.html#//apple_ref/doc/uid/TP40000939-CH1-SW8
+                if (remaining < 8) {
+                    throw new Mp4ContentError('Truncated meta atom');
+                }
                 // meta has 4 bytes of padding, ignore
                 const peekHeader = await tokenizer.peekToken(Header);
                 const paddingLength = peekHeader.name === 'hdlr' ? 0 : 4;
                 await tokenizer.ignore(paddingLength);
-                return this.readAtoms(tokenizer, dataHandler, this.getPayloadLength(remaining) - paddingLength);
+                return this.readAtoms(tokenizer, dataHandler, remaining - paddingLength);
             }
             default:
                 return dataHandler(this, remaining);

package/node_modules/baileys/node_modules/music-metadata/lib/mp4/AtomToken.d.ts

@@ -1,4 +1,4 @@
-import type { IToken, IGetToken } from 'strtok3';
+import type { IGetToken, IToken } from 'strtok3';
 declare const Mp4ContentError_base: {
     new (message: string): {
         readonly fileType: string;

package/node_modules/baileys/node_modules/music-metadata/lib/mp4/AtomToken.js

@@ -1,9 +1,8 @@
-import * as Token from 'token-types';
 import initDebug from 'debug';
+import * as Token from 'token-types';
 import { FourCcToken } from '../common/FourCC.js';
-import { makeUnexpectedFileContentError } from '../ParseError.js';
 import * as util from '../common/Util.js';
-import { FieldDecodingError } from '../ParseError.js';
+import { FieldDecodingError, makeUnexpectedFileContentError } from '../ParseError.js';
 const debug = initDebug('music-metadata:parser:MP4:atom');
 export class Mp4ContentError extends makeUnexpectedFileContentError('MP4') {
 }
@@ -11,8 +10,9 @@ export const Header = {
     len: 8,
     get: (buf, off) => {
         const length = Token.UINT32_BE.get(buf, off);
-        if (length < 0)
+        if (length < 0) {
             throw new Mp4ContentError('Invalid atom header length');
+        }
         return {
             length: BigInt(length),
             name: new Token.StringType(4, 'latin1').get(buf, off + 4)
@@ -226,7 +226,15 @@ export class TrackHeaderAtom {
         this.len = len;
     }
     get(buf, off) {
+        const available = Math.min(this.len, buf.length - off);
+        if (available < 4) {
+            throw new Mp4ContentError('Truncated tkhd header');
+        }
         const version = Token.UINT8.get(buf, off);
+        // Validate through the volume field, the last field currently decoded.
+        if ((version === 0 && available < 38) || (version === 1 && available < 50)) {
+            throw new Mp4ContentError('Truncated tkhd header');
+        }
         const flags = Token.UINT24_BE.get(buf, off + 1);
         switch (version) {
             case 0:
@@ -306,11 +314,23 @@ export class StsdAtom {
         this.len = len;
     }
     get(buf, off) {
+        const end = Math.min(off + this.len, buf.length);
+        if (end - off < stsdHeader.len) {
+            throw new Mp4ContentError('Truncated stsd header');
+        }
         const header = stsdHeader.get(buf, off);
         off += stsdHeader.len;
         const table = [];
         for (let n = 0; n < header.numberOfEntries; ++n) {
+            if (end - off < Token.UINT32_BE.len) {
+                throw new Mp4ContentError('Truncated stsd sample entry');
+            }
             const size = Token.UINT32_BE.get(buf, off); // Sample description size
+            // A SampleEntry needs its size, format, reserved bytes and data reference index.
+            // Requiring it to fit also bounds the loop by the available payload, not entry_count.
+            if (size < 16 || size > end - off) {
+                throw new Mp4ContentError(`Invalid stsd sample entry size: ${size}`);
+            }
             off += Token.UINT32_BE.len;
             table.push(new SampleDescriptionTable(size - Token.UINT32_BE.len).get(buf, off));
             // A SampleEntry extends Box, so its size covers the size field already stepped over
@@ -449,10 +469,12 @@ export class ChapterText {
 }
 function readTokenTable(buf, token, off, remainingLen, numberOfEntries) {
     debug(`remainingLen=${remainingLen}, numberOfEntries=${numberOfEntries} * token-len=${token.len}`);
-    if (remainingLen === 0)
+    if (remainingLen === 0) {
         return [];
-    if (remainingLen !== numberOfEntries * token.len)
+    }
+    if (remainingLen !== numberOfEntries * token.len) {
         throw new Mp4ContentError('mismatch number-of-entries with remaining atom-length');
+    }
     const entries = [];
     // parse offset-table
     for (let n = 0; n < numberOfEntries; ++n) {
@@ -539,7 +561,7 @@ export class TrackRunBox {
         }
         for (let n = 0; n < trun.sampleCount; ++n) {
             if (dynOffset >= this.len) {
-                debug("TrackRunBox size mismatch");
+                debug('TrackRunBox size mismatch');
                 break;
             }
             const sample = {};
@@ -579,7 +601,7 @@ export class HandlerBox {
             flags: Token.UINT24_BE.get(buf, off + 1),
             componentType: charTypeToken.get(buf, off + 4),
             handlerType: charTypeToken.get(buf, off + 8),
-            componentName: new Token.StringType(this.len - 28, 'utf-8').get(buf, off + 28),
+            componentName: new Token.StringType(this.len - 28, 'utf-8').get(buf, off + 28)
         };
     }
 }

package/node_modules/baileys/node_modules/music-metadata/lib/mp4/MP4Parser.d.ts

@@ -2,6 +2,8 @@ import { BasicParser } from '../common/BasicParser.js';
 import { Atom } from './Atom.js';
 export declare class MP4Parser extends BasicParser {
     private static read_BE_Integer;
+    private validatePayloadLength;
+    private readToken;
     private tracks;
     private hasVideoTrack;
     private hasAudioTrack;