Signed left shift UB in mp3dec_skip_id3v1 (APEv2 tag size)
@dawidpieper is already working on this.
Since Sep 25, 2026.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- c
- Domain
- audio-video-rtc
Research direction
Start at mp3dec_skip_id3v1() in minimp3_ex.h around line 153, where the APEv2 tag size is assembled from tag[0..3]; compare it with the equivalent code in mp3dec_check_vbrtag that was fixed in #140. Cast each element to uint32_t before shifting so the promoted int never overflows. Build the test harness with -fsanitize=undefined and confirm the reported left-shift diagnostic is gone. Note two pull requests (#143 closed unmerged, #154 open) already target this, so check their status before writing a patch.
Written by the indexing model from the issue text.
Description
Similar to the issue in mp3dec_check_vbrtag reported in #140, there's the same pattern in mp3dec_skip_id3v1() at minimp3_ex.h:153:
uint32_t tag_size = (uint32_t)(tag[3] << 24) | (tag[2] << 16) | (tag[1] << 8) | tag[0];
tag[3] is uint8_t, promoted to signed int before shifting. When tag[3] >= 128, tag[3] << 24 overflows signed int — UBSan reports:
minimp3_ex.h:153:47: runtime error: left shift of 250 by 24 places cannot be represented in type 'int'
Found with AFL++ and -fsanitize=undefined.
Casting to uint32_t before shifting fixes it.
- Dominant language
- C
- Stars
- 2k
- Forks
- 271
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from lieff/minimp3
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
[Bug]signed left-shift overflow in mp3dec_skip_id3v1 when parsing the APEv2 tag-size field (CWE-190)Possibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Integer overflow in Xing/Info VBR header parsing leads to ~10TB allocation (DoS)Possibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 Half a day Newbie friendliness 30/100
-
Difficulty 3/5 1-2 days Newbie friendliness 50/100
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 70/100
ly05010419/MacNativeGames#1340 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
area:stdlib bug found-by:cold-read kind:bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
InauguralSystems/EigenScript#2197 ·
Maintainers usually reply within 1 day
-
Hide the cursorOpen
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
seedds/nxnative#675 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 2 days