music-metadata 12.1.0 → 12.1.1

package/README.md

@@ -611,6 +611,17 @@ Returns a list of supported MIME-types. This may include some MIME-types which a
   Files, buffers, and Blobs support chapters whether `moov` appears before or after `mdat`.
   For forward-only streams, `moov` must appear before the chapter data.
 
+- `maxMemoryAllocation`: `number` (default: `67108864`, 64 MiB)
+
+  Maximum bytes buffered for a single metadata payload, accumulated Ogg packet, or tokenizer stream lookahead.
+  Must be a positive safe integer. Parsing rejects payloads above this limit before allocating them.
+  The parser configures this limit once on its `strtok3` tokenizers, including tokenizers for embedded tags.
+  Oversized tokenizer allocations or stream lookahead reject with `strtok3.BufferSizeError`.
+  When using `parseFromTokenizer()`, also configure `maxBufferSize` on the supplied tokenizer at creation.
+  Increase it for files with unusually large metadata or cover art, or lower it for constrained environments.
+  Audio/video data that is skipped does not count toward this limit. This does not cap total process memory:
+  decoded metadata, multiple retained tags, and temporary copies can require additional memory.
+
 - `mkvUseIndex`: `boolean` (default: `false`)
 
   When `true`, the parser uses the SeekHead index in Matroska (MKV) files to skip segment and cluster elements.

package/lib/ParserFactory.js

@@ -5,6 +5,7 @@ import { parse as mimeTypeParse } from 'media-typer';
 import { aiffParserLoader } from './aiff/AiffLoader.js';
 import { apeParserLoader } from './apev2/Apev2Loader.js';
 import { asfParserLoader } from './asf/AsfLoader.js';
+import { getMaxMemoryAllocation } from './common/Allocation.js';
 import { MetadataCollector } from './common/MetadataCollector.js';
 import { createAudioTrackInfo } from './common/TrackInfo.js';
 import { scanAppendingHeaders } from './core.js';
@@ -56,6 +57,7 @@ export class ParserFactory {
         this.parsers.push(parser);
     }
     async parse(tokenizer, parserLoader, opts = {}) {
+        getMaxMemoryAllocation(opts);
         if (tokenizer.supportsRandomAccess()) {
             debug('tokenizer supports random-access, scanning for appending headers');
             await scanAppendingHeaders(tokenizer, opts);
@@ -90,7 +92,7 @@ export class ParserFactory {
         debug(`Loading ${parserLoader.parserType} parser...`);
         const metadata = new MetadataCollector(opts);
         const ParserImpl = await parserLoader.load();
-        const parser = new ParserImpl(metadata, tokenizer, opts ?? {});
+        const parser = new ParserImpl(metadata, tokenizer, opts);
         debug(`Parser ${parserLoader.parserType} loaded`);
         await parser.parse();
         // Audio-only parsers describe their single stream through the format fields.

package/lib/aiff/AiffParser.js

@@ -1,6 +1,7 @@
 import initDebug from 'debug';
 import * as strtok3 from 'strtok3';
 import * as Token from 'token-types';
+import { getTokenizerOptions } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { FourCcToken } from '../common/FourCC.js';
 import { ID3v2Parser } from '../id3v2/ID3v2Parser.js';
@@ -18,11 +19,11 @@ const debug = initDebug('music-metadata:parser:aiff');
 export class AIFFParser extends BasicParser {
     isCompressed = null;
     async parse() {
-        const header = await this.tokenizer.readToken(iff.Header);
+        const header = await this.readToken(iff.Header);
         if (header.chunkID !== 'FORM') {
             throw new AiffContentError("Invalid Chunk-ID, expected 'FORM'"); // Not AIFF format
         }
-        const type = await this.tokenizer.readToken(FourCcToken);
+        const type = await this.readToken(FourCcToken);
         switch (type) {
             case 'AIFF':
                 this.metadata.setFormat('container', type);
@@ -41,7 +42,7 @@ export class AIFFParser extends BasicParser {
             while (!this.tokenizer.fileInfo.size ||
                 this.tokenizer.fileInfo.size - this.tokenizer.position >= iff.Header.len) {
                 debug(`Reading AIFF chunk at offset=${this.tokenizer.position}`);
-                const chunkHeader = await this.tokenizer.readToken(iff.Header);
+                const chunkHeader = await this.readToken(iff.Header);
                 const nextChunk = 2 * Math.round(chunkHeader.chunkSize / 2);
                 const bytesRead = await this.readData(chunkHeader);
                 await this.tokenizer.ignore(nextChunk - bytesRead);
@@ -63,7 +64,7 @@ export class AIFFParser extends BasicParser {
                 if (this.isCompressed === null) {
                     throw new AiffContentError('Failed to parse AIFF.COMM chunk when compression type is unknown');
                 }
-                const common = await this.tokenizer.readToken(new AiffToken.Common(header, this.isCompressed));
+                const common = await this.readToken(new AiffToken.Common(header, this.isCompressed));
                 this.metadata.setFormat('bitsPerSample', common.sampleSize);
                 this.metadata.setFormat('sampleRate', common.sampleRate);
                 this.metadata.setFormat('numberOfChannels', common.numChannels);
@@ -76,8 +77,8 @@ export class AIFFParser extends BasicParser {
             }
             case 'ID3 ': {
                 // ID3-meta-data
-                const id3_data = await this.tokenizer.readToken(new Token.Uint8ArrayType(header.chunkSize));
-                const rst = strtok3.fromBuffer(id3_data);
+                const id3_data = await this.readToken(new Token.Uint8ArrayType(header.chunkSize));
+                const rst = strtok3.fromBuffer(id3_data, getTokenizerOptions(this.options));
                 await new ID3v2Parser().parse(this.metadata, rst, this.options);
                 return header.chunkSize;
             }
@@ -97,7 +98,7 @@ export class AIFFParser extends BasicParser {
         }
     }
     async readTextChunk(header) {
-        const value = await this.tokenizer.readToken(new Token.StringType(header.chunkSize, 'ascii'));
+        const value = await this.readToken(new Token.StringType(header.chunkSize, 'ascii'));
         const values = value
             .split('\0')
             .map(v => v.trim())

package/lib/apev2/APEv2Parser.js

@@ -2,6 +2,7 @@ import { textDecode } from '@borewit/text-codec';
 import initDebug from 'debug';
 import * as strtok3 from 'strtok3';
 import { StringType } from 'token-types';
+import { getTokenizerOptions, readBuffer } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import * as util from '../common/Util.js';
 import { makeUnexpectedFileContentError } from '../ParseError.js';
@@ -60,8 +61,7 @@ export class APEv2Parser extends BasicParser {
         if (footer.ID !== preamble) {
             throw new ApeContentError('Unexpected APEv2 Footer ID preamble value');
         }
-        strtok3.fromBuffer(buffer);
-        const apeParser = new APEv2Parser(metadata, strtok3.fromBuffer(buffer), options);
+        const apeParser = new APEv2Parser(metadata, strtok3.fromBuffer(buffer, getTokenizerOptions(options)), options);
         return apeParser.parseTags(footer);
     }
     ape = {};
@@ -82,8 +82,7 @@ export class APEv2Parser extends BasicParser {
         if (this.tokenizer.fileInfo.size) {
             // Try to read the APEv2 header using just the footer-header
             const remaining = this.tokenizer.fileInfo.size - this.tokenizer.position; // ToDo: take ID3v1 into account
-            const buffer = new Uint8Array(remaining);
-            await this.tokenizer.readBuffer(buffer);
+            const buffer = await this.readTagValue(remaining);
             return APEv2Parser.parseTagFooter(this.metadata, buffer, this.options);
         }
     }
@@ -167,28 +166,7 @@ export class APEv2Parser extends BasicParser {
         }
     }
     async readTagValue(size) {
-        const chunkSize = 64 * 1024;
-        if ((!this.tokenizer.supportsRandomAccess() || this.tokenizer.fileInfo.size === undefined) && size > chunkSize) {
-            // Stream sizes may be unknown or untrustworthy. Only allocate the full
-            // value after all of its bytes have actually been read.
-            const chunks = [];
-            for (let remaining = size; remaining > 0;) {
-                const chunk = new Uint8Array(Math.min(remaining, chunkSize));
-                await this.tokenizer.readBuffer(chunk);
-                chunks.push(chunk);
-                remaining -= chunk.length;
-            }
-            const value = new Uint8Array(size);
-            let offset = 0;
-            for (const chunk of chunks) {
-                value.set(chunk, offset);
-                offset += chunk.length;
-            }
-            return value;
-        }
-        const value = new Uint8Array(size);
-        await this.tokenizer.readBuffer(value);
-        return value;
+        return readBuffer(this.tokenizer, size, this.options, undefined, message => new ApeContentError(message));
     }
     async parseDescriptorExpansion(lenExp) {
         await this.tokenizer.ignore(lenExp);

package/lib/asf/AsfParser.js

@@ -1,6 +1,7 @@
 import initDebug from 'debug';
 import { EndOfStreamError } from 'strtok3';
 import * as Token from 'token-types';
+import { validateAllocation } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { TrackType } from '../type.js';
 import AsfGuid from './AsfGuid.js';
@@ -8,7 +9,6 @@ import * as AsfObject from './AsfObject.js';
 import { AsfContentParseError } from './AsfObject.js';
 const debug = initDebug('music-metadata:parser:ASF');
 const headerType = 'asf';
-const maxAsfMetadataObjectSize = 16 * 1024 * 1024;
 /**
  * Windows Media Metadata Usage Guidelines
  * - Ref: https://msdn.microsoft.com/en-us/library/ms867702.aspx
@@ -24,7 +24,7 @@ export class AsfParser extends BasicParser {
     codecs = [];
     streamBitrates = new Map();
     async parse() {
-        const header = await this.tokenizer.readToken(AsfObject.TopLevelHeaderObjectToken);
+        const header = await this.readToken(AsfObject.TopLevelHeaderObjectToken);
         if (!header.objectId.equals(AsfGuid.HeaderObject)) {
             throw new AsfContentParseError(`expected asf header; but was not found; got: ${header.objectId.str}`);
         }
@@ -89,7 +89,7 @@ export class AsfParser extends BasicParser {
                 case AsfObject.FilePropertiesObject.guid.str: {
                     // 3.2
                     this.validateAllocationSize(payloadSize, 'File Properties Object');
-                    const fpo = await this.tokenizer.readToken(new AsfObject.FilePropertiesObject(header));
+                    const fpo = await this.readToken(new AsfObject.FilePropertiesObject(header));
                     this.metadata.setFormat('duration', Number(fpo.playDuration / BigInt(1000)) / 10000 - Number(fpo.preroll) / 1000);
                     this.metadata.setFormat('bitrate', fpo.maximumBitrate);
                     break;
@@ -97,7 +97,7 @@ export class AsfParser extends BasicParser {
                 case AsfObject.StreamPropertiesObject.guid.str: {
                     // 3.3
                     this.validateAllocationSize(payloadSize, 'Stream Properties Object');
-                    const spo = await this.tokenizer.readToken(new AsfObject.StreamPropertiesObject(header));
+                    const spo = await this.readToken(new AsfObject.StreamPropertiesObject(header));
                     this.metadata.setFormat('container', `ASF/${spo.streamType}`);
                     if (spo.streamType === 'audio') {
                         this.metadata.setFormat('hasAudio', true);
@@ -114,7 +114,7 @@ export class AsfParser extends BasicParser {
                     if (payloadSize < extensionHeaderToken.len) {
                         throw new AsfContentParseError(`ASF Header Extension Object payload is too small: ${payloadSize} bytes`);
                     }
-                    const extHeader = await this.tokenizer.readToken(extensionHeaderToken);
+                    const extHeader = await this.readToken(extensionHeaderToken);
                     const expectedExtensionSize = payloadSize - extensionHeaderToken.len;
                     if (extHeader.extensionDataSize !== expectedExtensionSize) {
                         throw new AsfContentParseError(`ASF extension data size ${extHeader.extensionDataSize} does not match enclosing payload size ${expectedExtensionSize}`);
@@ -124,12 +124,12 @@ export class AsfParser extends BasicParser {
                 }
                 case AsfObject.ContentDescriptionObjectState.guid.str: // 3.10
                     this.validateAllocationSize(payloadSize, 'Content Description Object');
-                    tags = await this.tokenizer.readToken(new AsfObject.ContentDescriptionObjectState(header));
+                    tags = await this.readToken(new AsfObject.ContentDescriptionObjectState(header));
                     await this.addTags(tags);
                     break;
                 case AsfObject.ExtendedContentDescriptionObjectState.guid.str: // 3.11
                     this.validateAllocationSize(payloadSize, 'Extended Content Description Object');
-                    tags = await this.tokenizer.readToken(new AsfObject.ExtendedContentDescriptionObjectState(header));
+                    tags = await this.readToken(new AsfObject.ExtendedContentDescriptionObjectState(header));
                     await this.addTags(tags);
                     break;
                 case AsfGuid.CodecListObject.str: {
@@ -154,13 +154,13 @@ export class AsfParser extends BasicParser {
                     if (payloadSize < 2) {
                         throw new AsfContentParseError('Truncated Stream Bitrate Properties Object');
                     }
-                    const count = await this.tokenizer.readToken(Token.UINT16_LE);
+                    const count = await this.readToken(Token.UINT16_LE);
                     if (count * 6 > payloadSize - 2) {
                         throw new AsfContentParseError('ASF stream bitrate records exceed object payload');
                     }
                     for (let index = 0; index < count; ++index) {
-                        const streamNumber = (await this.tokenizer.readToken(Token.UINT16_LE)) & 0x7f;
-                        this.streamBitrates.set(streamNumber, await this.tokenizer.readToken(Token.UINT32_LE));
+                        const streamNumber = (await this.readToken(Token.UINT16_LE)) & 0x7f;
+                        this.streamBitrates.set(streamNumber, await this.readToken(Token.UINT32_LE));
                     }
                     await this.ignorePayload(payloadSize - 2 - count * 6, 'Stream Bitrate Properties Object');
                     break;
@@ -188,7 +188,7 @@ export class AsfParser extends BasicParser {
         if (remainingSize < AsfObject.HeaderObjectToken.len) {
             throw new AsfContentParseError(`Insufficient ASF ${containerType} data for an object header: ${remainingSize} bytes`);
         }
-        const header = await this.tokenizer.readToken(AsfObject.HeaderObjectToken);
+        const header = await this.readToken(AsfObject.HeaderObjectToken);
         if (header.objectSize > remainingSize) {
             throw new AsfContentParseError(`ASF ${containerType} object size ${header.objectSize} exceeds remaining ${containerType} payload size ${remainingSize}`);
         }
@@ -209,9 +209,7 @@ export class AsfParser extends BasicParser {
         return payloadSize;
     }
     validateAllocationSize(payloadSize, objectType) {
-        if (payloadSize > maxAsfMetadataObjectSize) {
-            throw new AsfContentParseError(`ASF ${objectType} payload size ${payloadSize} exceeds allocation limit ${maxAsfMetadataObjectSize}`);
-        }
+        validateAllocation(payloadSize, this.options, message => new AsfContentParseError(`ASF ${objectType}: ${message}`));
     }
     async ignorePayload(payloadSize, objectType) {
         let ignored;
@@ -236,7 +234,7 @@ export class AsfParser extends BasicParser {
                 case AsfObject.ExtendedStreamPropertiesObjectState.guid.str: {
                     // 4.1
                     this.validateAllocationSize(payloadSize, 'Extended Stream Properties Object');
-                    const extended = await this.tokenizer.readToken(new AsfObject.ExtendedStreamPropertiesObjectState(header));
+                    const extended = await this.readToken(new AsfObject.ExtendedStreamPropertiesObjectState(header));
                     if (extended.streamPropertiesObject) {
                         const stream = extended.streamPropertiesObject;
                         this.streams.set(stream.streamNumber, stream);
@@ -247,14 +245,14 @@ export class AsfParser extends BasicParser {
                 case AsfObject.MetadataObjectState.guid.str: {
                     // 4.7
                     this.validateAllocationSize(payloadSize, 'Metadata Object');
-                    const moTags = await this.tokenizer.readToken(new AsfObject.MetadataObjectState(header));
+                    const moTags = await this.readToken(new AsfObject.MetadataObjectState(header));
                     await this.addTags(moTags);
                     break;
                 }
                 case AsfObject.MetadataLibraryObjectState.guid.str: {
                     // 4.8
                     this.validateAllocationSize(payloadSize, 'Metadata Library Object');
-                    const mlTags = await this.tokenizer.readToken(new AsfObject.MetadataLibraryObjectState(header));
+                    const mlTags = await this.readToken(new AsfObject.MetadataLibraryObjectState(header));
                     await this.addTags(mlTags);
                     break;
                 }

package/lib/common/Allocation.d.ts

@@ -0,0 +1,14 @@
+import type { IGetToken } from '@tokenizer/token';
+import { type IFileInfo, type ITokenizer, type ITokenizerOptions } from 'strtok3';
+import type { IOptions } from '../type.js';
+type ErrorFactory = (message: string) => Error;
+export declare function getMaxMemoryAllocation(options: IOptions): number;
+/** Configure the tokenizer safety net once, using the same limit as parser-owned buffers. */
+export declare function getTokenizerOptions(options: IOptions, fileInfo?: IFileInfo): ITokenizerOptions;
+/** Check untrusted lengths before allocating, including accumulated stream payloads. */
+export declare function validateAllocation(length: number, options: IOptions, makeError?: ErrorFactory): void;
+/** Read only bounded chunks from streams; an advertised stream size does not prove bytes exist. */
+export declare function readBuffer(tokenizer: ITokenizer, length: number, options: IOptions, position?: number, makeError?: ErrorFactory): Promise<Uint8Array>;
+/** Bound custom tokenizer reads and buffer large stream payloads incrementally. */
+export declare function readToken<T>(tokenizer: ITokenizer, token: IGetToken<T>, options: IOptions, position?: number, makeError?: ErrorFactory): Promise<T>;
+export {};

package/lib/common/Allocation.js

@@ -0,0 +1,70 @@
+import { EndOfStreamError } from 'strtok3';
+import { UnexpectedFileContentError } from '../ParseError.js';
+const defaultMaxMemoryAllocation = 64 * 1024 * 1024;
+const readChunkSize = 64 * 1024;
+const allocationError = message => new UnexpectedFileContentError('metadata', message);
+export function getMaxMemoryAllocation(options) {
+    const limit = options.maxMemoryAllocation ?? defaultMaxMemoryAllocation;
+    if (!Number.isSafeInteger(limit) || limit <= 0) {
+        throw new RangeError('maxMemoryAllocation must be a positive safe integer');
+    }
+    return limit;
+}
+/** Configure the tokenizer safety net once, using the same limit as parser-owned buffers. */
+export function getTokenizerOptions(options, fileInfo) {
+    return { maxBufferSize: getMaxMemoryAllocation(options), fileInfo };
+}
+/** Check untrusted lengths before allocating, including accumulated stream payloads. */
+export function validateAllocation(length, options, makeError = allocationError) {
+    if (!Number.isSafeInteger(length) || length < 0) {
+        throw makeError(`Invalid allocation size: ${length}`);
+    }
+    const limit = getMaxMemoryAllocation(options);
+    if (length > limit) {
+        throw makeError(`Metadata size ${length} exceeds allocation limit ${limit} (buffering limit)`);
+    }
+}
+function validateAvailableBytes(tokenizer, length, position) {
+    if (tokenizer.fileInfo.size !== undefined && length > tokenizer.fileInfo.size - position) {
+        throw new EndOfStreamError();
+    }
+}
+/** Read only bounded chunks from streams; an advertised stream size does not prove bytes exist. */
+export async function readBuffer(tokenizer, length, options, position = tokenizer.position, makeError = allocationError) {
+    validateAllocation(length, options, makeError);
+    validateAvailableBytes(tokenizer, length, position);
+    if ((!tokenizer.supportsRandomAccess() || tokenizer.fileInfo.size === undefined) && length > readChunkSize) {
+        const chunks = [];
+        for (let remaining = length; remaining > 0;) {
+            const chunk = new Uint8Array(Math.min(remaining, readChunkSize));
+            const bytesRead = await tokenizer.readBuffer(chunk, { position });
+            if (bytesRead !== chunk.length) {
+                throw new EndOfStreamError();
+            }
+            chunks.push(chunk);
+            remaining -= chunk.length;
+            position += chunk.length;
+        }
+        const buffer = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+            buffer.set(chunk, offset);
+            offset += chunk.length;
+        }
+        return buffer;
+    }
+    const buffer = new Uint8Array(length);
+    if ((await tokenizer.readBuffer(buffer, { position })) !== length) {
+        throw new EndOfStreamError();
+    }
+    return buffer;
+}
+/** Bound custom tokenizer reads and buffer large stream payloads incrementally. */
+export async function readToken(tokenizer, token, options, position = tokenizer.position, makeError = allocationError) {
+    validateAllocation(token.len, options, makeError);
+    validateAvailableBytes(tokenizer, token.len, position);
+    if (token.len <= readChunkSize) {
+        return tokenizer.readToken(token, position);
+    }
+    return token.get(await readBuffer(tokenizer, token.len, options, position, makeError), 0);
+}

package/lib/common/BasicParser.d.ts

@@ -1,3 +1,4 @@
+import type { IGetToken } from '@tokenizer/token';
 import type { ITokenizer } from 'strtok3';
 import type { ITokenParser } from '../ParserFactory.js';
 import type { IOptions } from '../type.js';
@@ -13,5 +14,6 @@ export declare abstract class BasicParser implements ITokenParser {
      * @param {IOptions} options Parsing options
      */
     constructor(metadata: INativeMetadataCollector, tokenizer: ITokenizer, options: IOptions);
+    protected readToken<T>(token: IGetToken<T>, position?: number): Promise<T>;
     abstract parse(): Promise<void>;
 }

package/lib/common/BasicParser.js

@@ -1,3 +1,4 @@
+import { getMaxMemoryAllocation, readToken } from './Allocation.js';
 export class BasicParser {
     metadata;
     tokenizer;
@@ -9,8 +10,12 @@ export class BasicParser {
      * @param {IOptions} options Parsing options
      */
     constructor(metadata, tokenizer, options) {
+        getMaxMemoryAllocation(options);
         this.metadata = metadata;
         this.tokenizer = tokenizer;
         this.options = options;
     }
+    readToken(token, position) {
+        return readToken(this.tokenizer, token, this.options, position);
+    }
 }

package/lib/core.js

@@ -3,6 +3,7 @@
  */
 import { fromBlob, fromBuffer, fromWebStream } from 'strtok3';
 import { APEv2Parser } from './apev2/APEv2Parser.js';
+import { getTokenizerOptions } from './common/Allocation.js';
 import { hasID3v1Header } from './id3v1/ID3v1Parser.js';
 import { getLyricsHeaderLength } from './lyrics3/Lyrics3.js';
 import { ParserFactory } from './ParserFactory.js';
@@ -17,7 +18,7 @@ export { LyricsContentType, TimestampFormat, TrackType } from './type.js';
  * @returns Metadata
  */
 export async function parseBlob(blob, options = {}) {
-    const tokenizer = fromBlob(blob);
+    const tokenizer = fromBlob(blob, getTokenizerOptions(options));
     try {
         return await parseFromTokenizer(tokenizer, options);
     }
@@ -33,9 +34,7 @@ export async function parseBlob(blob, options = {}) {
  * @returns Metadata
  */
 export async function parseWebStream(webStream, fileInfo, options = {}) {
-    const tokenizer = fromWebStream(webStream, {
-        fileInfo: typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo
-    });
+    const tokenizer = fromWebStream(webStream, getTokenizerOptions(options, typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo));
     try {
         return await parseFromTokenizer(tokenizer, options);
     }
@@ -52,9 +51,7 @@ export async function parseWebStream(webStream, fileInfo, options = {}) {
  * Ref: https://github.com/Borewit/strtok3/blob/e6938c81ff685074d5eb3064a11c0b03ca934c1d/src/index.ts#L15
  */
 export async function parseBuffer(uint8Array, fileInfo, options = {}) {
-    const tokenizer = fromBuffer(uint8Array, {
-        fileInfo: typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo
-    });
+    const tokenizer = fromBuffer(uint8Array, getTokenizerOptions(options, typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo));
     return parseFromTokenizer(tokenizer, options);
 }
 /**

package/lib/dsdiff/DsdiffParser.d.ts

@@ -22,6 +22,9 @@ export declare class DsdiffContentParseError extends DsdiffContentParseError_bas
  */
 export declare class DsdiffParser extends BasicParser {
     parse(): Promise<void>;
+    private validateChunkSize;
+    private requireChunkSize;
+    private ignoreBytes;
     private readFmt8Chunks;
     private readData;
     private handleSoundPropertyChunks;

package/lib/dsdiff/DsdiffParser.js

@@ -1,12 +1,13 @@
 import initDebug from 'debug';
 import * as strtok3 from 'strtok3';
 import * as Token from 'token-types';
+import { getTokenizerOptions } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { FourCcToken } from '../common/FourCC.js';
 import { ID3v2Parser } from '../id3v2/ID3v2Parser.js';
 import { makeUnexpectedFileContentError } from '../ParseError.js';
 import { ChunkHeader64 } from './DsdiffToken.js';
-const debug = initDebug('music-metadata:parser:aiff');
+const debug = initDebug('music-metadata:parser:dsdiff');
 export class DsdiffContentParseError extends makeUnexpectedFileContentError('DSDIFF') {
 }
 /**
@@ -17,12 +18,14 @@ export class DsdiffContentParseError extends makeUnexpectedFileContentError('DSD
  */
 export class DsdiffParser extends BasicParser {
     async parse() {
-        const header = await this.tokenizer.readToken(ChunkHeader64);
+        const header = await this.readToken(ChunkHeader64);
         if (header.chunkID !== 'FRM8') {
             throw new DsdiffContentParseError('Unexpected chunk-ID');
         }
+        this.validateChunkSize(header);
+        this.requireChunkSize(header, FourCcToken.len);
         this.metadata.setAudioOnly();
-        const type = (await this.tokenizer.readToken(FourCcToken)).trim();
+        const type = (await this.readToken(FourCcToken)).trim();
         switch (type) {
             case 'DSD':
                 this.metadata.setFormat('container', `DSDIFF/${type}`);
@@ -32,13 +35,40 @@ export class DsdiffParser extends BasicParser {
                 throw new DsdiffContentParseError(`Unsupported DSDIFF type: ${type}`);
         }
     }
+    validateChunkSize(header, remainingSize) {
+        const size = header.chunkSize;
+        if (size < 0n || size > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new DsdiffContentParseError(`Invalid chunk size: ${size}`);
+        }
+        const paddedSize = size + (size & 1n);
+        if (remainingSize !== undefined && paddedSize > remainingSize) {
+            throw new DsdiffContentParseError(`Chunk ${header.chunkID} size ${size} exceeds its enclosing chunk`);
+        }
+        const fileSize = this.tokenizer.fileInfo.size;
+        if (fileSize !== undefined && paddedSize > BigInt(fileSize - this.tokenizer.position)) {
+            throw new DsdiffContentParseError(`Chunk ${header.chunkID} size ${size} exceeds remaining file size`);
+        }
+    }
+    requireChunkSize(header, minimum) {
+        if (header.chunkSize < BigInt(minimum)) {
+            throw new DsdiffContentParseError(`Chunk ${header.chunkID} is too small: ${header.chunkSize}`);
+        }
+    }
+    async ignoreBytes(length) {
+        if ((await this.tokenizer.ignore(Number(length))) !== Number(length)) {
+            throw new DsdiffContentParseError('Unexpected end of chunk');
+        }
+    }
     async readFmt8Chunks(remainingSize) {
         while (remainingSize >= ChunkHeader64.len) {
-            const chunkHeader = await this.tokenizer.readToken(ChunkHeader64);
+            const chunkHeader = await this.readToken(ChunkHeader64);
+            this.validateChunkSize(chunkHeader, remainingSize - BigInt(ChunkHeader64.len));
             //  If the data is an odd number of bytes in length, a pad byte must be added at the end
             debug(`Chunk id=${chunkHeader.chunkID}`);
             await this.readData(chunkHeader);
-            remainingSize -= BigInt(ChunkHeader64.len) + chunkHeader.chunkSize;
+            const padding = chunkHeader.chunkSize & 1n;
+            await this.ignoreBytes(padding);
+            remainingSize -= BigInt(ChunkHeader64.len) + chunkHeader.chunkSize + padding;
         }
     }
     async readData(header) {
@@ -46,14 +76,16 @@ export class DsdiffParser extends BasicParser {
         const p0 = this.tokenizer.position;
         switch (header.chunkID.trim()) {
             case 'FVER': {
+                this.requireChunkSize(header, Token.UINT32_LE.len);
                 // 3.1 FORMAT VERSION CHUNK
-                const version = await this.tokenizer.readToken(Token.UINT32_LE);
+                const version = await this.readToken(Token.UINT32_LE);
                 debug(`DSDIFF version=${version}`);
                 break;
             }
             case 'PROP': {
+                this.requireChunkSize(header, FourCcToken.len);
                 // 3.2 PROPERTY CHUNK
-                const propType = await this.tokenizer.readToken(FourCcToken);
+                const propType = await this.readToken(FourCcToken);
                 if (propType !== 'SND ') {
                     throw new DsdiffContentParseError('Unexpected PROP-chunk ID');
                 }
@@ -62,8 +94,8 @@ export class DsdiffParser extends BasicParser {
             }
             case 'ID3': {
                 // Unofficial ID3 tag support
-                const id3_data = await this.tokenizer.readToken(new Token.Uint8ArrayType(Number(header.chunkSize)));
-                const rst = strtok3.fromBuffer(id3_data);
+                const id3_data = await this.readToken(new Token.Uint8ArrayType(Number(header.chunkSize)));
+                const rst = strtok3.fromBuffer(id3_data, getTokenizerOptions(this.options));
                 await new ID3v2Parser().parse(this.metadata, rst, this.options);
                 break;
             }
@@ -82,34 +114,39 @@ export class DsdiffParser extends BasicParser {
         const remaining = header.chunkSize - BigInt(this.tokenizer.position - p0);
         if (remaining > 0) {
             debug(`After Parsing chunk, remaining ${remaining} bytes`);
-            await this.tokenizer.ignore(Number(remaining));
+            await this.ignoreBytes(remaining);
         }
     }
     async handleSoundPropertyChunks(remainingSize) {
         debug(`Parsing sound-property-chunks, remainingSize=${remainingSize}`);
-        while (remainingSize > 0) {
-            const sndPropHeader = await this.tokenizer.readToken(ChunkHeader64);
+        while (remainingSize >= BigInt(ChunkHeader64.len)) {
+            const sndPropHeader = await this.readToken(ChunkHeader64);
+            this.validateChunkSize(sndPropHeader, remainingSize - BigInt(ChunkHeader64.len));
             debug(`Sound-property-chunk[ID=${sndPropHeader.chunkID}, size=${sndPropHeader.chunkSize}]`);
             const p0 = this.tokenizer.position;
             switch (sndPropHeader.chunkID.trim()) {
                 case 'FS': {
+                    this.requireChunkSize(sndPropHeader, Token.UINT32_BE.len);
                     // 3.2.1 Sample Rate Chunk
-                    const sampleRate = await this.tokenizer.readToken(Token.UINT32_BE);
+                    const sampleRate = await this.readToken(Token.UINT32_BE);
                     this.metadata.setFormat('sampleRate', sampleRate);
                     break;
                 }
                 case 'CHNL': {
+                    this.requireChunkSize(sndPropHeader, Token.UINT16_BE.len);
                     // 3.2.2 Channels Chunk
-                    const numChannels = await this.tokenizer.readToken(Token.UINT16_BE);
+                    const numChannels = await this.readToken(Token.UINT16_BE);
                     this.metadata.setFormat('numberOfChannels', numChannels);
                     await this.handleChannelChunks(sndPropHeader.chunkSize - BigInt(Token.UINT16_BE.len));
                     break;
                 }
                 case 'CMPR': {
+                    this.requireChunkSize(sndPropHeader, FourCcToken.len + Token.UINT8.len);
                     // 3.2.3 Compression Type Chunk
-                    const compressionIdCode = (await this.tokenizer.readToken(FourCcToken)).trim();
-                    const count = await this.tokenizer.readToken(Token.UINT8);
-                    const compressionName = await this.tokenizer.readToken(new Token.StringType(count, 'ascii'));
+                    const compressionIdCode = (await this.readToken(FourCcToken)).trim();
+                    const count = await this.readToken(Token.UINT8);
+                    this.requireChunkSize(sndPropHeader, FourCcToken.len + Token.UINT8.len + count);
+                    const compressionName = await this.readToken(new Token.StringType(count, 'ascii'));
                     if (compressionIdCode === 'DSD') {
                         this.metadata.setFormat('lossless', true);
                         this.metadata.setFormat('bitsPerSample', 1);
@@ -118,32 +155,39 @@ export class DsdiffParser extends BasicParser {
                     break;
                 }
                 case 'ABSS': {
+                    this.requireChunkSize(sndPropHeader, 8);
                     // 3.2.4 Absolute Start Time Chunk
-                    const hours = await this.tokenizer.readToken(Token.UINT16_BE);
-                    const minutes = await this.tokenizer.readToken(Token.UINT8);
-                    const seconds = await this.tokenizer.readToken(Token.UINT8);
-                    const samples = await this.tokenizer.readToken(Token.UINT32_BE);
+                    const hours = await this.readToken(Token.UINT16_BE);
+                    const minutes = await this.readToken(Token.UINT8);
+                    const seconds = await this.readToken(Token.UINT8);
+                    const samples = await this.readToken(Token.UINT32_BE);
                     debug(`ABSS ${hours}:${minutes}:${seconds}.${samples}`);
                     break;
                 }
                 case 'LSCO': {
+                    this.requireChunkSize(sndPropHeader, Token.UINT16_BE.len);
                     // 3.2.5 Loudspeaker Configuration Chunk
-                    const lsConfig = await this.tokenizer.readToken(Token.UINT16_BE);
+                    const lsConfig = await this.readToken(Token.UINT16_BE);
                     debug(`LSCO lsConfig=${lsConfig}`);
                     break;
                 }
                 default:
                     debug(`Unknown sound-property-chunk[ID=${sndPropHeader.chunkID}, size=${sndPropHeader.chunkSize}]`);
-                    await this.tokenizer.ignore(Number(sndPropHeader.chunkSize));
+                    await this.ignoreBytes(sndPropHeader.chunkSize);
             }
             const remaining = sndPropHeader.chunkSize - BigInt(this.tokenizer.position - p0);
             if (remaining > 0) {
                 debug(`After Parsing sound-property-chunk ${sndPropHeader.chunkSize}, remaining ${remaining} bytes`);
-                await this.tokenizer.ignore(Number(remaining));
+                await this.ignoreBytes(remaining);
             }
-            remainingSize -= BigInt(ChunkHeader64.len) + sndPropHeader.chunkSize;
+            const padding = sndPropHeader.chunkSize & 1n;
+            await this.ignoreBytes(padding);
+            remainingSize -= BigInt(ChunkHeader64.len) + sndPropHeader.chunkSize + padding;
             debug(`Parsing sound-property-chunks, remainingSize=${remainingSize}`);
         }
+        if (remainingSize !== 0n) {
+            throw new DsdiffContentParseError('Incomplete sound-property chunk header');
+        }
         if (this.metadata.format.lossless &&
             this.metadata.format.sampleRate &&
             this.metadata.format.numberOfChannels &&
@@ -154,14 +198,10 @@ export class DsdiffParser extends BasicParser {
     }
     async handleChannelChunks(remainingSize) {
         debug(`Parsing channel-chunks, remainingSize=${remainingSize}`);
-        const channels = [];
         while (remainingSize >= FourCcToken.len) {
-            const channelId = await this.tokenizer.readToken(FourCcToken);
+            const channelId = await this.readToken(FourCcToken);
             debug(`Channel[ID=${channelId}]`);
-            channels.push(channelId);
             remainingSize -= BigInt(FourCcToken.len);
         }
-        debug(`Channels: ${channels.join(', ')}`);
-        return channels;
     }
 }

package/lib/ebml/EbmlIterator.d.ts

@@ -1,4 +1,5 @@
 import { type ITokenizer } from 'strtok3';
+import type { IOptions } from '../type.js';
 import { type IElementType, type ITree, type ValueType } from './types.js';
 declare const EbmlContentError_base: {
     new (message: string): {
@@ -45,6 +46,7 @@ export type IElementListener = {
  * WEBM VP8 AUDIO FILE
  */
 export declare class EbmlIterator {
+    private readonly options;
     private parserMap;
     private ebmlMaxIDLength;
     private ebmlMaxSizeLength;
@@ -53,9 +55,10 @@ export declare class EbmlIterator {
      * @param {ITokenizer} tokenizer Input
      * @param tokenizer
      */
-    constructor(tokenizer: ITokenizer);
+    constructor(tokenizer: ITokenizer, options?: IOptions);
     iterate(dtdElement: IElementType, posDone: number, listener: IElementListener): Promise<ITree>;
     private parseContainer;
+    private ignore;
     private readVintData;
     private readElement;
     private readFloat;

package/lib/ebml/EbmlIterator.js

@@ -2,6 +2,7 @@ import initDebug from 'debug';
 import { EndOfStreamError } from 'strtok3';
 import * as Token from 'token-types';
 import { Float32_BE, Float64_BE, StringType, UINT8 } from 'token-types';
+import { readBuffer } from '../common/Allocation.js';
 import { makeUnexpectedFileContentError } from '../ParseError.js';
 import { DataType } from './types.js';
 const debug = initDebug('music-metadata:parser:ebml');
@@ -22,6 +23,7 @@ export const ParseAction = {
  * WEBM VP8 AUDIO FILE
  */
 export class EbmlIterator {
+    options;
     parserMap = new Map();
     ebmlMaxIDLength = 4;
     ebmlMaxSizeLength = 8;
@@ -30,7 +32,8 @@ export class EbmlIterator {
      * @param {ITokenizer} tokenizer Input
      * @param tokenizer
      */
-    constructor(tokenizer) {
+    constructor(tokenizer, options = {}) {
+        this.options = options;
         this.tokenizer = tokenizer;
         this.parserMap.set(DataType.uint, e => this.readUint(e));
         this.parserMap.set(DataType.string, e => this.readString(e));
@@ -104,11 +107,11 @@ export class EbmlIterator {
                         break;
                     case ParseAction.IgnoreElement:
                         debug(`Ignore element: name=${getElementPath(child)}, element.id=0x${element.id}, container=${!!child.container} at position=${elementPosition}`);
-                        await this.tokenizer.ignore(element.len);
+                        await this.ignore(element.len, posDone);
                         break;
                     case ParseAction.SkipSiblings:
                         debug(`Ignore remaining container, at: name=${getElementPath(child)}, element.id=0x${element.id}, container=${!!child.container} at position=${elementPosition}`);
-                        await this.tokenizer.ignore(posDone - this.tokenizer.position);
+                        await this.ignore(posDone - this.tokenizer.position, posDone);
                         break;
                     case ParseAction.TerminateParsing:
                         debug(`Terminate parsing at element: name=${getElementPath(child)}, element.id=0x${element.id}, container=${!!child.container} at position=${elementPosition}`);
@@ -118,16 +121,26 @@ export class EbmlIterator {
             else {
                 switch (element.id) {
                     case 0xec: // void
-                        await this.tokenizer.ignore(element.len);
+                        await this.ignore(element.len, posDone);
                         break;
                     default:
                         debug(`parseEbml: parent=${getElementPath(dtdElement)}, unknown child: id=${element.id.toString(16)} at position=${elementPosition}`);
-                        await this.tokenizer.ignore(element.len);
+                        await this.ignore(element.len, posDone);
                 }
             }
         }
         return tree;
     }
+    async ignore(length, posDone) {
+        // Unknown-size EBML containers may advertise lengths above the safe integer range.
+        // Bound skips by the enclosing container and known input before passing them to the tokenizer.
+        const end = Math.min(posDone, this.tokenizer.fileInfo.size ?? Number.POSITIVE_INFINITY);
+        const boundedLength = Math.min(length, end - this.tokenizer.position);
+        if (!Number.isSafeInteger(boundedLength) || boundedLength < 0) {
+            throw new EbmlContentError(`Invalid element length: ${length}`);
+        }
+        await this.tokenizer.ignore(boundedLength);
+    }
     async readVintData(maxLength) {
         const msb = await this.tokenizer.peekNumber(UINT8);
         let mask = 0x80;
@@ -180,28 +193,7 @@ export class EbmlIterator {
         return rawString.replace(/\x00.*$/g, '');
     }
     async readBuffer(e) {
-        const chunkSize = 64 * 1024;
-        if ((!this.tokenizer.supportsRandomAccess() || this.tokenizer.fileInfo.size === undefined) && e.len > chunkSize) {
-            // Neither a declared container size nor an advertised stream size proves these bytes exist.
-            // Allocate incrementally, and only assemble the leaf after reading its payload.
-            const chunks = [];
-            for (let remaining = e.len; remaining > 0;) {
-                const chunk = new Uint8Array(Math.min(remaining, chunkSize));
-                await this.tokenizer.readBuffer(chunk);
-                chunks.push(chunk);
-                remaining -= chunk.length;
-            }
-            const buf = new Uint8Array(e.len);
-            let offset = 0;
-            for (const chunk of chunks) {
-                buf.set(chunk, offset);
-                offset += chunk.length;
-            }
-            return buf;
-        }
-        const buf = new Uint8Array(e.len);
-        await this.tokenizer.readBuffer(buf);
-        return buf;
+        return readBuffer(this.tokenizer, e.len, this.options, undefined, message => new EbmlContentError(message));
     }
 }
 function readUIntBE(buf, len) {

package/lib/flac/FlacParser.js

@@ -13,14 +13,14 @@ class FlacContentError extends makeUnexpectedFileContentError('FLAC') {
 export class FlacParser extends AbstractID3Parser {
     vorbisParser = new VorbisStream(this.metadata, this.options);
     async postId3v2Parse() {
-        const fourCC = await this.tokenizer.readToken(FourCcToken);
+        const fourCC = await this.readToken(FourCcToken);
         if (fourCC.toString() !== 'fLaC') {
             throw new FlacContentError('Invalid FLAC preamble');
         }
         let blockHeader;
         do {
             // Read block header
-            blockHeader = await this.tokenizer.readToken(Flac.BlockHeader);
+            blockHeader = await this.readToken(Flac.BlockHeader);
             // Parse block data
             await this.parseDataBlock(blockHeader);
         } while (!blockHeader.lastBlock);
@@ -60,7 +60,7 @@ export class FlacParser extends AbstractID3Parser {
         if (dataLen !== Flac.BlockStreamInfo.len) {
             throw new FlacContentError('Unexpected block-stream-info length');
         }
-        const streamInfo = await this.tokenizer.readToken(Flac.BlockStreamInfo);
+        const streamInfo = await this.readToken(Flac.BlockStreamInfo);
         this.metadata.setFormat('container', 'FLAC');
         this.processsStreamInfo(streamInfo);
     }
@@ -83,7 +83,7 @@ export class FlacParser extends AbstractID3Parser {
      * Ref: https://www.xiph.org/vorbis/doc/Vorbis_I_spec.html#x1-640004.2.3
      */
     async readComment(dataLen) {
-        const data = await this.tokenizer.readToken(new Uint8ArrayType(dataLen));
+        const data = await this.readToken(new Uint8ArrayType(dataLen));
         return this.parseComment(data);
     }
     /**
@@ -97,9 +97,12 @@ export class FlacParser extends AbstractID3Parser {
             this.metadata.setFormat('tool', vendor);
         }
         const commentListLength = decoder.readInt32();
-        const tags = new Array(commentListLength);
+        if (commentListLength > Math.floor(decoder.remaining / 4)) {
+            throw new FlacContentError(`Vorbis comment count ${commentListLength} exceeds remaining data`);
+        }
+        const tags = [];
         for (let i = 0; i < commentListLength; i++) {
-            tags[i] = decoder.parseUserComment();
+            tags.push(decoder.parseUserComment());
         }
         await Promise.all(tags.map(tag => {
             if (tag.key === 'ENCODER') {
@@ -112,7 +115,7 @@ export class FlacParser extends AbstractID3Parser {
         if (this.options.skipCovers) {
             return this.tokenizer.ignore(dataLen);
         }
-        return this.addPictureTag(await this.tokenizer.readToken(new VorbisPictureToken(dataLen)));
+        return this.addPictureTag(await this.readToken(new VorbisPictureToken(dataLen)));
     }
     addPictureTag(picture) {
         return this.addTag('METADATA_BLOCK_PICTURE', picture);

package/lib/id3v2/ID3v2Parser.js

@@ -1,4 +1,5 @@
 import * as Token from 'token-types';
+import { readToken } from '../common/Allocation.js';
 import { getFrameHeaderLength, readFrameHeader } from './FrameHeader.js';
 import { FrameParser, Id3v2ContentError } from './FrameParser.js';
 import { ExtendedHeader, ID3v2Header } from './ID3v2Token.js';
@@ -84,7 +85,7 @@ export class ID3v2Parser {
         return this.parseId3Data(this.id3Header.size - extendedHeaderSize);
     }
     async parseId3Data(dataLen) {
-        const uint8Array = await this.tokenizer.readToken(new Token.Uint8ArrayType(dataLen));
+        const uint8Array = await readToken(this.tokenizer, new Token.Uint8ArrayType(dataLen), this.options, undefined, message => new Id3v2ContentError(message));
         for (const tag of this.parseMetadata(uint8Array)) {
             switch (tag.id) {
                 case 'TXXX':

package/lib/index.js

@@ -3,6 +3,7 @@
  */
 import initDebug from 'debug';
 import { fromFile, fromStream } from 'strtok3';
+import { getTokenizerOptions } from './common/Allocation.js';
 import { CouldNotDetermineFileTypeError, parseFromTokenizer, UnsupportedFileTypeError } from './core.js';
 import { ParserFactory } from './ParserFactory.js';
 export * from './core.js';
@@ -15,9 +16,7 @@ const debug = initDebug('music-metadata:parser');
  * @returns Metadata
  */
 export async function parseStream(stream, fileInfo, options = {}) {
-    const tokenizer = await fromStream(stream, {
-        fileInfo: typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo
-    });
+    const tokenizer = await fromStream(stream, getTokenizerOptions(options, typeof fileInfo === 'string' ? { mimeType: fileInfo } : fileInfo));
     try {
         return await parseFromTokenizer(tokenizer, options);
     }
@@ -33,7 +32,7 @@ export async function parseStream(stream, fileInfo, options = {}) {
  */
 export async function parseFile(filePath, options = {}) {
     debug(`parseFile: ${filePath}`);
-    const fileTokenizer = await fromFile(filePath);
+    const fileTokenizer = await fromFile(filePath, getTokenizerOptions(options));
     const parserFactory = new ParserFactory();
     try {
         const parserLoader = parserFactory.findLoaderForExtension(filePath);

package/lib/matroska/MatroskaParser.js

@@ -21,7 +21,7 @@ export class MatroskaParser extends BasicParser {
     flagUseIndexToSkipClusters = this.options.mkvUseIndex ?? false;
     async parse() {
         const containerSize = this.tokenizer.fileInfo.size ?? Number.MAX_SAFE_INTEGER;
-        const matroskaIterator = new EbmlIterator(this.tokenizer);
+        const matroskaIterator = new EbmlIterator(this.tokenizer, this.options);
         debug('Initializing DTD end MatroskaIterator');
         await matroskaIterator.iterate(matroskaDtd, containerSize, {
             startNext: element => {

package/lib/mp4/MP4Parser.d.ts

@@ -1,9 +1,10 @@
+import type { IGetToken } from '@tokenizer/token';
 import { BasicParser } from '../common/BasicParser.js';
 import { Atom } from './Atom.js';
 export declare class MP4Parser extends BasicParser {
     private static read_BE_Integer;
     private validatePayloadLength;
-    private readToken;
+    protected readToken<T>(token: IGetToken<T>, position?: number): Promise<T>;
     private tracks;
     private mediaDataRanges;
     private streamedChapters;

package/lib/mp4/MP4Parser.js

@@ -2,6 +2,7 @@ import { textDecode } from '@borewit/text-codec';
 import initDebug from 'debug';
 import * as Token from 'token-types';
 import { uint8ArrayToHex } from 'uint8array-extras';
+import { readToken, validateAllocation } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { Genres } from '../id3v1/ID3v1Parser.js';
 import { TrackType } from '../type.js';
@@ -123,13 +124,10 @@ export class MP4Parser extends BasicParser {
     // Metadata and sample tables are buffered; media data is skipped separately.
     // A bound is also necessary for streams whose total size is unknown.
     validatePayloadLength(length) {
-        if (!Number.isSafeInteger(length) || length < 0 || length > 64 * 1024 * 1024) {
-            throw new Mp4ContentError(`Atom payload exceeds the 64 MiB buffering limit: ${length}`);
-        }
+        validateAllocation(length, this.options, message => new Mp4ContentError(message));
     }
     async readToken(token, position) {
-        this.validatePayloadLength(token.len);
-        return this.tokenizer.readToken(token, position);
+        return readToken(this.tokenizer, token, this.options, position, message => new Mp4ContentError(message));
     }
     tracks = new Map();
     mediaDataRanges = [];

package/lib/ogg/OggParser.js

@@ -1,6 +1,7 @@
 import initDebug from 'debug';
 import { EndOfStreamError } from 'strtok3';
 import * as Token from 'token-types';
+import { readToken } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { createAudioTrackInfo } from '../common/TrackInfo.js';
 import { makeUnexpectedFileContentError } from '../ParseError.js';
@@ -34,7 +35,7 @@ class OggStream {
         debug('serial=%s page#=%s, Ogg.id=%s', header.streamSerialNumber, header.pageSequenceNo, header.capturePattern);
         const segmentTable = await tokenizer.readToken(new SegmentTable(header));
         debug('totalPageSize=%s', segmentTable.totalPageSize);
-        const pageData = await tokenizer.readToken(new Token.Uint8ArrayType(segmentTable.totalPageSize));
+        const pageData = await readToken(tokenizer, new Token.Uint8ArrayType(segmentTable.totalPageSize), this.options);
         this.payloadBytes += pageData.length;
         debug('firstPage=%s, lastPage=%s, continued=%s', header.headerType.firstPage, header.headerType.lastPage, header.headerType.continued);
         if (header.headerType.firstPage) {

package/lib/ogg/vorbis/VorbisDecoder.d.ts

@@ -2,6 +2,7 @@ export declare class VorbisDecoder {
     private readonly data;
     private offset;
     constructor(data: Uint8Array, offset: number);
+    get remaining(): number;
     readInt32(): number;
     readStringUtf8(): string;
     parseUserComment(): {

package/lib/ogg/vorbis/VorbisDecoder.js

@@ -1,5 +1,8 @@
 import { textDecode } from '@borewit/text-codec';
 import * as Token from 'token-types';
+import { makeUnexpectedFileContentError } from '../../ParseError.js';
+class VorbisCommentError extends makeUnexpectedFileContentError('Vorbis') {
+}
 export class VorbisDecoder {
     data;
     offset;
@@ -7,13 +10,22 @@ export class VorbisDecoder {
         this.data = data;
         this.offset = offset;
     }
+    get remaining() {
+        return this.data.length - this.offset;
+    }
     readInt32() {
+        if (this.remaining < 4) {
+            throw new VorbisCommentError('Truncated Vorbis comment length');
+        }
         const value = Token.UINT32_LE.get(this.data, this.offset);
         this.offset += 4;
         return value;
     }
     readStringUtf8() {
         const len = this.readInt32();
+        if (len > this.remaining) {
+            throw new VorbisCommentError(`Vorbis comment length ${len} exceeds remaining data ${this.remaining}`);
+        }
         const value = textDecode(this.data.subarray(this.offset, this.offset + len), 'utf-8');
         this.offset += len;
         return value;

package/lib/ogg/vorbis/VorbisStream.d.ts

@@ -23,6 +23,7 @@ export declare class VorbisContentError extends VorbisContentError_base {
  */
 export declare class VorbisStream implements IPageConsumer {
     private pageSegments;
+    private bufferedPageLength;
     protected metadata: INativeMetadataCollector;
     protected options: IOptions;
     protected lastPageHeader?: IPageHeader;
@@ -35,7 +36,7 @@ export declare class VorbisStream implements IPageConsumer {
      * @param pageData Page data
      */
     parsePage(header: IPageHeader, pageData: Uint8Array): Promise<void>;
-    private static mergeUint8Arrays;
+    private mergeUint8Arrays;
     flush(): Promise<void>;
     parseUserComment(pageData: Uint8Array, offset: number): Promise<number>;
     addTag(id: string, value: string | IVorbisPicture): Promise<void>;

package/lib/ogg/vorbis/VorbisStream.js

@@ -1,5 +1,6 @@
 import debugInit from 'debug';
 import * as Token from 'token-types';
+import { validateAllocation } from '../../common/Allocation.js';
 import { makeUnexpectedFileContentError } from '../../ParseError.js';
 import { CommonHeader, IdentificationHeader, VorbisPictureToken } from './Vorbis.js';
 import { VorbisDecoder } from './VorbisDecoder.js';
@@ -12,6 +13,7 @@ export class VorbisContentError extends makeUnexpectedFileContentError('Vorbis')
  */
 export class VorbisStream {
     pageSegments = [];
+    bufferedPageLength = 0;
     metadata;
     options;
     lastPageHeader;
@@ -36,30 +38,36 @@ export class VorbisStream {
                 if (this.pageSegments.length === 0) {
                     throw new VorbisContentError('Cannot continue on previous page');
                 }
+                validateAllocation(this.bufferedPageLength + pageData.length, this.options);
                 this.pageSegments.push(pageData);
+                this.bufferedPageLength += pageData.length;
             }
             if (header.headerType.lastPage || !header.headerType.continued) {
                 // Flush page segments
                 if (this.pageSegments.length > 0) {
-                    const fullPage = VorbisStream.mergeUint8Arrays(this.pageSegments);
+                    const fullPage = this.mergeUint8Arrays(this.pageSegments);
                     await this.parseFullPage(fullPage);
                 }
                 // Reset page segments
+                this.bufferedPageLength = header.headerType.lastPage ? 0 : pageData.length;
+                validateAllocation(this.bufferedPageLength, this.options);
                 this.pageSegments = header.headerType.lastPage ? [] : [pageData];
             }
         }
     }
-    static mergeUint8Arrays(arrays) {
+    mergeUint8Arrays(arrays) {
         const totalSize = arrays.reduce((acc, e) => acc + e.length, 0);
+        validateAllocation(totalSize, this.options);
         const merged = new Uint8Array(totalSize);
-        arrays.forEach((array, i, _arrays) => {
-            const offset = _arrays.slice(0, i).reduce((acc, e) => acc + e.length, 0);
+        let offset = 0;
+        for (const array of arrays) {
             merged.set(array, offset);
-        });
+            offset += array.length;
+        }
         return merged;
     }
     async flush() {
-        await this.parseFullPage(VorbisStream.mergeUint8Arrays(this.pageSegments));
+        await this.parseFullPage(this.mergeUint8Arrays(this.pageSegments));
     }
     async parseUserComment(pageData, offset) {
         const decoder = new VorbisDecoder(pageData, offset);

package/lib/type.d.ts

@@ -596,6 +596,12 @@ export interface IAudioMetadata extends INativeAudioMetadata {
  */
 export type ParserType = 'mpeg' | 'apev2' | 'mp4' | 'asf' | 'flac' | 'ogg' | 'aiff' | 'wavpack' | 'riff' | 'musepack' | 'dsf' | 'dsdiff' | 'adts' | 'matroska';
 export interface IOptions {
+    /**
+     * Maximum bytes buffered for a single metadata payload, accumulated Ogg packet, or tokenizer stream lookahead.
+     * Defaults to 64 MiB (67108864 bytes). Must be a positive safe integer.
+     * This is not a limit on total process memory or the size of skipped audio/video data.
+     */
+    maxMemoryAllocation?: number;
     /**
      * default: `false`, if set to `true`, it will parse the whole media file if required to determine the duration.
      */

package/lib/wav/WaveParser.js

@@ -1,6 +1,7 @@
 import initDebug from 'debug';
 import * as strtok3 from 'strtok3';
 import * as Token from 'token-types';
+import { getTokenizerOptions } from '../common/Allocation.js';
 import { BasicParser } from '../common/BasicParser.js';
 import { FourCcToken } from '../common/FourCC.js';
 import { ID3v2Parser } from '../id3v2/ID3v2Parser.js';
@@ -29,7 +30,7 @@ export class WaveParser extends BasicParser {
     avgBytesPerSec = 0;
     header;
     async parse() {
-        const riffHeader = await this.tokenizer.readToken(riff.Header);
+        const riffHeader = await this.readToken(riff.Header);
         debug(`pos=${this.tokenizer.position}, parse: chunkID=${riffHeader.chunkID}`);
         if (riffHeader.chunkID !== 'RIFF') {
             return; // Not RIFF format
@@ -43,7 +44,7 @@ export class WaveParser extends BasicParser {
         await this.flushInfoTags();
     }
     async parseRiffChunk(chunkSize) {
-        const type = await this.tokenizer.readToken(FourCcToken);
+        const type = await this.readToken(FourCcToken);
         this.metadata.setFormat('container', type);
         switch (type) {
             case 'WAVE':
@@ -54,7 +55,7 @@ export class WaveParser extends BasicParser {
     }
     async readWaveChunk(remaining) {
         while (remaining >= riff.Header.len) {
-            const header = await this.tokenizer.readToken(riff.Header);
+            const header = await this.readToken(riff.Header);
             remaining -= riff.Header.len + header.chunkSize;
             if (header.chunkSize > remaining) {
                 this.metadata.addWarning('Data chunk size exceeds file size');
@@ -66,7 +67,7 @@ export class WaveParser extends BasicParser {
                     if (header.chunkSize < 8) {
                         throw new WaveContentError('CSET chunk must contain at least 8 bytes');
                     }
-                    const cset = await this.tokenizer.readToken(new Token.Uint8ArrayType(header.chunkSize));
+                    const cset = await this.readToken(new Token.Uint8ArrayType(header.chunkSize));
                     this.codePage = Token.UINT16_LE.get(cset, 0);
                     if (!this.getInfoEncoding()) {
                         this.metadata.addWarning(`Unsupported RIFF CSET code page: ${this.codePage}; LIST/INFO tags will be omitted`);
@@ -79,11 +80,11 @@ export class WaveParser extends BasicParser {
                     break;
                 case 'fact': // extended Format chunk,
                     this.metadata.setFormat('lossless', false);
-                    this.fact = await this.tokenizer.readToken(new WaveChunk.FactChunk(header));
+                    this.fact = await this.readToken(new WaveChunk.FactChunk(header));
                     break;
                 case 'fmt ': {
                     // The Util Chunk, non-PCM Formats
-                    const fmt = await this.tokenizer.readToken(new WaveChunk.Format(header));
+                    const fmt = await this.readToken(new WaveChunk.Format(header));
                     let subFormat = WaveChunk.WaveFormatNameMap[fmt.wFormatTag];
                     if (!subFormat) {
                         debug(`WAVE/non-PCM format=${fmt.wFormatTag}`);
@@ -100,8 +101,8 @@ export class WaveParser extends BasicParser {
                 case 'id3 ': // The way Picard, FooBar currently stores, ID3 meta-data
                 case 'ID3 ': {
                     // The way Mp3Tags stores ID3 meta-data
-                    const id3_data = await this.tokenizer.readToken(new Token.Uint8ArrayType(header.chunkSize));
-                    const rst = strtok3.fromBuffer(id3_data);
+                    const id3_data = await this.readToken(new Token.Uint8ArrayType(header.chunkSize));
+                    const rst = strtok3.fromBuffer(id3_data, getTokenizerOptions(this.options));
                     await new ID3v2Parser().parse(this.metadata, rst, this.options);
                     break;
                 }
@@ -140,7 +141,7 @@ export class WaveParser extends BasicParser {
                 }
                 case 'bext': {
                     // Broadcast Audio Extension chunk	https://tech.ebu.ch/docs/tech/tech3285.pdf
-                    const bext = await this.tokenizer.readToken(BroadcastAudioExtensionChunk);
+                    const bext = await this.readToken(BroadcastAudioExtensionChunk);
                     for (const key of Object.keys(bext)) {
                         await this.metadata.addTag('exif', `bext.${key}`, bext[key]);
                     }
@@ -165,7 +166,7 @@ export class WaveParser extends BasicParser {
         }
     }
     async parseListTag(listHeader) {
-        const listType = await this.tokenizer.readToken(new Token.StringType(4, 'latin1'));
+        const listType = await this.readToken(new Token.StringType(4, 'latin1'));
         debug('pos=%s, parseListTag: chunkID=RIFF/WAVE/LIST/%s', this.tokenizer.position, listType);
         switch (listType) {
             case 'INFO':
@@ -178,9 +179,9 @@ export class WaveParser extends BasicParser {
     }
     async parseRiffInfoTags(chunkSize) {
         while (chunkSize >= 8) {
-            const header = await this.tokenizer.readToken(riff.Header);
+            const header = await this.readToken(riff.Header);
             const valueToken = new riff.ListInfoTagValue(header);
-            const bytes = await this.tokenizer.readToken(new Token.Uint8ArrayType(valueToken.len));
+            const bytes = await this.readToken(new Token.Uint8ArrayType(valueToken.len));
             if (this.codePage === undefined) {
                 this.metadata.registerTagType('exif');
                 this.pendingInfoTags.push({ header, bytes });

package/lib/wavpack/WavPackParser.js

@@ -70,8 +70,11 @@ export class WavPackParser extends BasicParser {
         while (remaining > MetadataIdToken.len) {
             const id = await this.tokenizer.readToken(MetadataIdToken);
             const dataSizeInWords = await this.tokenizer.readNumber(id.largeBlock ? Token.UINT24_LE : Token.UINT8);
-            const data = new Uint8Array(dataSizeInWords * 2 - (id.isOddSize ? 1 : 0));
-            await this.tokenizer.readBuffer(data);
+            const headerSize = MetadataIdToken.len + (id.largeBlock ? Token.UINT24_LE.len : Token.UINT8.len);
+            if (dataSizeInWords * 2 > remaining - headerSize) {
+                throw new WavPackContentError('Metadata sub-block exceeds its enclosing block');
+            }
+            const data = await this.readToken(new Token.Uint8ArrayType(dataSizeInWords * 2 - (id.isOddSize ? 1 : 0)));
             debug(`Metadata Sub-Blocks functionId=0x${id.functionId.toString(16)}, id.largeBlock=${id.largeBlock},data-size=${data.length}`);
             switch (id.functionId) {
                 case 0x0: // ID_DUMMY: could be used to pad WavPack blocks

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "music-metadata",
   "description": "Music metadata parser for Node.js, supporting virtual any audio and tag format.",
-  "version": "12.1.0",
+  "version": "12.1.1",
   "author": {
     "name": "Borewit",
     "url": "https://github.com/Borewit"
@@ -124,7 +124,7 @@
     "debug": "^4.4.3",
     "file-type": "^22.1.1",
     "media-typer": "^2.0.0",
-    "strtok3": "^10.3.5",
+    "strtok3": "^10.4.0",
     "token-types": "^6.1.2",
     "uint8array-extras": "^1.6.0",
     "win-guid": "^0.2.1"