From 099a76227f3ee5113db3c91b7f693586a5459530 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Mon, 4 May 2026 14:13:09 +0200
Subject: [PATCH] midifile: reject midi files with invalid values

>64 tracks will overflow the track array and a division of 0 will cause
a division by zero later.
---
 src/tools/midifile.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/tools/midifile.c b/src/tools/midifile.c
index 974cec6e5..364063aa4 100644
--- a/src/tools/midifile.c
+++ b/src/tools/midifile.c
@@ -177,6 +177,12 @@ static int open_read(struct midi_file *mf, const char *filename, struct midi_fil
 	if ((res = read_mthd(mf)) < 0)
 		goto exit_close;
 
+	if (mf->info.ntracks > SPA_N_ELEMENTS(mf->tracks) ||
+	    mf->info.division == 0) {
+		res = -EINVAL;
+		goto exit_close;
+	}
+
 	mf->tempo = DEFAULT_TEMPO;
 	mf->tick = 0;