Merge pull request #483 from wikimedia/upstream/midi-header-validation

MIDI: Check for minimum filessize of a valid MIDI header

Author: JamesHeinrich

getid3/module.audio.midi.php

@@ -46,6 +46,15 @@ public function Analyze() {
 
 		$this->fseek($info['avdataoffset']);
 		$MIDIdata = $this->fread($this->getid3->fread_buffer_size());
+
+		$minHeaderSize = 14; // MIDI header (4+4+2+2+2)
+		$minTrackHeaderSize = 8; // Track header (4+4)
+		$minTotalSize = $minHeaderSize + $minTrackHeaderSize;
+		if ($info['filesize'] < $minTotalSize || strlen($MIDIdata) < $minTotalSize) {
+			$this->error('File too small to be a valid MIDI file.');
+			return false;
+		}
+
 		$offset = 0;
 		$MIDIheaderID = substr($MIDIdata, $offset, 4); // 'MThd'
 		if ($MIDIheaderID != GETID3_MIDI_MAGIC_MTHD) {