GHSA-q45f-7qmf-37x3: 
Python Analyse et atténuation de la vulnérabilité

Impact

The limit on output size is applied to each track, not to a whole run. An image whose table of contents lists many tracks that each claim the full playing time passes the check for every track, and positions with no audio are written as silence. A sparse image of a few megabytes of real data can so produce tens of gigabytes of output and fill the disk.

Patches

Fixed in 0.5.1.

Workarounds

Convert only images you trust, or onto a filesystem with a quota. Found in a private review requested by the maintainer.

Verification

The fix was developed privately and reviewed by an independent reviewer before release. On the release tree, before publication: the full test suite (311 passed, the 16 expected skips), the same suite under AddressSanitizer and UndefinedBehaviorSanitizer, the byte-for-byte comparison tests against sacd_extract, and a comparison of 0.5.0 with the fixed tree on three real discs in 35 modes each (105 runs, no difference in output for ordinary discs). The release pull request then ran the project CI (CodeQL, semgrep, ThreadSanitizer, macOS and Windows).