GHSA-F94X-6692-553Q music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...