Merge pull request #18224 from ScottishTapWater/fix/flac-atl-vendor-guard

Upgrade ATL to 7.18.0 to fix malformed FLAC hangs

Directory.Packages.props

@@ -80,7 +80,7 @@
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
     <PackageVersion Include="System.Text.Json" Version="10.0.11" />
     <PackageVersion Include="TagLibSharp" Version="2.3.0" />
-    <PackageVersion Include="z440.atl.core" Version="7.16.0" />
+    <PackageVersion Include="z440.atl.core" Version="7.18.0" />
     <PackageVersion Include="TMDbLib" Version="3.0.0" />
     <PackageVersion Include="UTF.Unknown" Version="2.7.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />

tests/Jellyfin.Providers.Tests/MediaInfo/AtlFlacRegressionTests.cs

@@ -0,0 +1,26 @@
+using System.IO;
+using ATL;
+using Xunit;
+
+namespace Jellyfin.Providers.Tests.MediaInfo;
+
+public class AtlFlacRegressionTests
+{
+    [Fact(Timeout = 5000)]
+    public void AtlParser_MalformedFlac_DoesNotHang()
+    {
+        // The 456-byte Vorbis comment block claims a 1024-byte vendor string.
+        byte[] fixture = [
+            (byte)'f', (byte)'L', (byte)'a', (byte)'C',
+            0, 0, 0, 34,
+            .. new byte[34],
+            0x84, 0, 1, 200,
+            0, 4, 0, 0,
+            .. new byte[452]
+        ];
+
+        // ATL 7.16 hangs on this stream.
+        using var stream = new MemoryStream(fixture);
+        _ = new Track(stream, ".flac");
+    }
+}