Denial of service (unbounded iteration) in libmysofa SOFA parsing

A crafted .sofa file makes mysofa_load_data() run effectively forever (100% CPU, no return, memory flat). Any application parsing untrusted SOFA files can be hung this way — libmysofa is used by ffmpeg’s SOFA/HRTF loading, among others.

The dataspace dimension size is bounds-checked in one dataspace-message parser but not the other: readOHDRHeaderMessageDataspace1() (src/hdf/dataobject.c:70) rejects dimension_size[i] > 1000000, but readOHDRHeaderMessageDataspace2() (:106) applies no such check. A version-2 dataspace message can therefore carry an arbitrary uint64 dimension size, and readDataDim() (:846) then loops for (i = 0; i < ds->dimension_size[dim]; i++) over that unbounded (and nested, so multiplicative) bound — an astronomical iteration count that never returns. The int loop counter against a uint64 bound is also a signed-overflow hazard.

Fix: apply the v1 parser’s guard to the v2 parser (return MYSOFA_INVALID_FORMAT when dimension_size[i] > 1000000), which makes the PoC reject immediately instead of hanging.

Christian Hoene confirmed the issue fixed on main on 19 July 2026. Commit 50c61c47b289 adds the missing bound exactly as proposed; 6cc5b15a73e9 adds broader malformed-input hardening and is included in release v1.3.5 (published under GitHub tag latest). The original 91,409-byte PoC was recovered from the disclosure email and retested against 6cc5b15a73e9 on 20 July: parsing returns immediately with MYSOFA_INVALID_FORMAT, with no hang or ASan/UBSan finding. Christian Hoene approved publication on 20 July 2026.