From c94bbb55bc84d76094061097098009f9da0abaab Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Fri, 8 May 2026 17:00:56 +0200
Subject: [PATCH] midifile: read up to 4 bytes for the varlen

---
 src/tools/midifile.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/tools/midifile.c b/src/tools/midifile.c
index 2bfd9224e..6fce3a330 100644
--- a/src/tools/midifile.c
+++ b/src/tools/midifile.c
@@ -108,14 +108,18 @@ static int parse_varlen(struct midi_file *mf, struct midi_track *tr, uint32_t *r
 {
 	uint32_t value = 0;
 	uint8_t data[1];
+	int i;
 
-	while (mf_read(mf, data, 1) == 1) {
+	for (i = 0; i < 4; i++) {
+		if (mf_read(mf, data, 1) != 1)
+			return -EINVAL;
 		value = (value << 7) | (data[0] & 0x7f);
-		if ((data[0] & 0x80) == 0)
-			break;
+		if ((data[0] & 0x80) == 0) {
+			*result = value;
+			return 0;
+		}
 	}
-	*result = value;
-	return 0;
+	return -EINVAL;
 }
 
 static int read_delta_time(struct midi_file *mf, struct midi_track *tr)