Segfault with fuzzed file

[tholin]

Parsing the following file with the tagreader example results in a segfault
https://www.dropbox.com/s/5gd3xsbn01jofwt/taglib_musepack_segfault.mpc

$ gdb --args ~/repository/taglib/build/examples/tagreader taglib_musepack_segfault.mpc 
GNU gdb (Gentoo 7.7.1 p1) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/cocobo/repository/taglib/build/examples/tagreader...done.
(gdb) r
Starting program: /home/cocobo/repository/taglib/build/examples/tagreader taglib_musepack_segfault.mpc
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
******************** "taglib_musepack_segfault.mpc" ********************

Program received signal SIGSEGV, Segmentation fault.
TagLib::MPC::Properties::readSV8 (this=this@entry=0x612210, file=file@entry=0x611d00)
    at /home/cocobo/repository/taglib/taglib/mpc/mpcproperties.cpp:205
205           d->version = data[pos];
(gdb) bt full
#0  TagLib::MPC::Properties::readSV8 (this=this@entry=0x612210, file=file@entry=0x611d00)
    at /home/cocobo/repository/taglib/taglib/mpc/mpcproperties.cpp:205
        data = {_vptr.ByteVector = 0x7ffff7dd4650 , static null = {
            _vptr.ByteVector = 0x7ffff7dd4650 , 
            static null = , d = 0x610b40}, 
          d = 0x611e90}
        pos = 4
        begSilence = 
        packetType = {_vptr.ByteVector = 0x7ffff7dd4650 , 
          static null = {_vptr.ByteVector = 0x7ffff7dd4650 , 
            static null = , d = 0x610b40}, 
          d = 0x611c80}
        packetSizeLength = 1
        packetSize = 
        dataSize = 0
        readSH = true
        readRG = false
#1  0x00007ffff7a4bfe3 in TagLib::MPC::Properties::Properties (this=0x612210, file=0x611d00, 
    streamLength=19, style=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/mpc/mpcproperties.cpp:86
        magic = {_vptr.ByteVector = 0x7ffff7dd4650 , 
          static null = {_vptr.ByteVector = 0x7ffff7dd4650 , 
            static null = , d = 0x610b40}, 
          d = 0x611e10}
#2  0x00007ffff7a49197 in TagLib::MPC::File::read (this=this@entry=0x611d00, 
    readProperties=readProperties@entry=true)
    at /home/cocobo/repository/taglib/taglib/mpc/mpcfile.cpp:320
No locals.
#3  0x00007ffff7a495af in TagLib::MPC::File::File (this=0x611d00, file=, 
    readProperties=, propertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/mpc/mpcfile.cpp:98
No locals.
#4  0x00007ffff7b98813 in TagLib::FileRef::create (
    fileName=0x7fffffffde6b "taglib_musepack_segfault.mpc", readAudioProperties=, 
    audioPropertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/fileref.cpp:255
        it = 
        ext = {_vptr.String = 0x7ffff7dd4510 , static null = {
            _vptr.String = 0x7ffff7dd4510 , 
            static null = , 
            static WCharByteOrder = TagLib::String::UTF16LE, d = 0x610af0}, 
          static WCharByteOrder = TagLib::String::UTF16LE, d = 0x611dc0}
#5  0x00007ffff7b99f72 in TagLib::FileRef::FileRef (this=0x7fffffffd8b0, fileName=, 
    readAudioProperties=, audioPropertiesStyle=)
    at /home/cocobo/repository/taglib/taglib/fileref.cpp:83
No locals.
#6  0x0000000000401d80 in main (argc=, argv=)
    at /home/cocobo/repository/taglib/examples/tagreader.cpp:41
        f = {_vptr.FileRef = 0x7ffff7dd6690 , d = 0x7ffff6d31b60}
        i = 
#7  0x00007ffff6d4adc5 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#8  0x0000000000405341 in _start ()
No symbol table info available.