Panic mid > len in src/wavpack/properties.rs

[qarmin]

Reproducer

I tried this code:

#![no_main]

use libfuzzer_sys::{fuzz_target, Corpus};
use lofty::file::AudioFile;
use lofty::file::{FileType, TaggedFileExt};
use lofty::probe::Probe;

const ALL_FILE_TYPES: &[FileType] = &[
    FileType::Aac,
    FileType::Aiff,
    FileType::Ape,
    FileType::Flac,
    FileType::Mpeg,
    FileType::Mp4,
    FileType::Mpc,
    FileType::Opus,
    FileType::Vorbis,
    FileType::Speex,
    FileType::Wav,
    FileType::WavPack,
];

fuzz_target!(|data: &[u8]| -> Corpus {
    let mut corpus = Corpus::Reject;
    for i in ALL_FILE_TYPES {
        let s = std::io::Cursor::new(data);
        let tagged_file = match Probe::with_file_type(s, *i).read() {
            Ok(t) => t,
            Err(_e) => {
                continue;
            }
        };
        corpus = Corpus::Keep;
        tagged_file.properties();
        tagged_file.tags();
        tagged_file.primary_tag();
    }

    corpus
});

Summary

thread 'main' panicked at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/wavpack/properties.rs:417:31:
mid > len
stack backtrace:
   0: rust_begin_unwind
             at /rustc/a47555110cf09b3ed59811d9b02235443e76a595/library/std/src/panicking.rs:665:5
   1: core::panicking::panic_fmt
             at /rustc/a47555110cf09b3ed59811d9b02235443e76a595/library/core/src/panicking.rs:76:14
   2: core::slice::<impl [T]>::split_at
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/slice/mod.rs:1877:21
   3: lofty::wavpack::properties::get_extended_meta_info
             at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/wavpack/properties.rs:417:25
   4: lofty::wavpack::properties::read_properties
             at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/wavpack/properties.rs:158:20
   5: lofty::wavpack::read::read_from
             at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/wavpack/read.rs:56:4
   6: <lofty::wavpack::WavPackFile as lofty::file::audio_file::AudioFile>::read_from
             at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/wavpack/mod.rs:14:10
   7: lofty::probe::Probe<R>::read
             at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/dd4e926/lofty/src/probe.rs:479:26
   8: lofty::check_file
             at /home/runner/work/Automated-Fuzzer/Automated-Fuzzer/src/crates/lofty/src/main.rs:42:33
   9: lofty::main
             at /home/runner/work/Automated-Fuzzer/Automated-Fuzzer/src/crates/lofty/src/main.rs:26:9
  10: core::ops::function::FnOnce::call_once
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

crash-68a2215c732ecb202998d3bd8b0de932e5e0301d_minimized.zip

Expected behavior

No response

Assets

No response