An M4A file containing a sub-atom with a size of zero in the —- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated.