From 6fb25e1730b892b2ff31771da3e667847fb6d1c2 Mon Sep 17 00:00:00 2001
From: James Hughes <james@pyrosoftsolutions.co.uk>
Date: Wed, 30 Sep 2026 13:35:53 +0100
Subject: [PATCH] Upgrade ATL to 7.18.0 and test malformed FLAC parsing

---
 Directory.Packages.props                      |  2 +-
 .../MediaInfo/AtlFlacRegressionTests.cs       | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 tests/Jellyfin.Providers.Tests/MediaInfo/AtlFlacRegressionTests.cs

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 38cf513124..17ae5ac125 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -80,7 +80,7 @@
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
     <PackageVersion Include="System.Text.Json" Version="10.0.11" />
     <PackageVersion Include="TagLibSharp" Version="2.3.0" />
-    <PackageVersion Include="z440.atl.core" Version="7.16.0" />
+    <PackageVersion Include="z440.atl.core" Version="7.18.0" />
     <PackageVersion Include="TMDbLib" Version="3.0.0" />
     <PackageVersion Include="UTF.Unknown" Version="2.7.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
diff --git a/tests/Jellyfin.Providers.Tests/MediaInfo/AtlFlacRegressionTests.cs b/tests/Jellyfin.Providers.Tests/MediaInfo/AtlFlacRegressionTests.cs
new file mode 100644
index 0000000000..75ca0233f3
--- /dev/null
+++ b/tests/Jellyfin.Providers.Tests/MediaInfo/AtlFlacRegressionTests.cs
@@ -0,0 +1,26 @@
+using System.IO;
+using ATL;
+using Xunit;
+
+namespace Jellyfin.Providers.Tests.MediaInfo;
+
+public class AtlFlacRegressionTests
+{
+    [Fact(Timeout = 5000)]
+    public void AtlParser_MalformedFlac_DoesNotHang()
+    {
+        // The 456-byte Vorbis comment block claims a 1024-byte vendor string.
+        byte[] fixture = [
+            (byte)'f', (byte)'L', (byte)'a', (byte)'C',
+            0, 0, 0, 34,
+            .. new byte[34],
+            0x84, 0, 1, 200,
+            0, 4, 0, 0,
+            .. new byte[452]
+        ];
+
+        // ATL 7.16 hangs on this stream.
+        using var stream = new MemoryStream(fixture);
+        _ = new Track(stream, ".flac");
+    }
+}