file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

@@ -1415,6 +1415,7 @@ export class FileTypeParser {
 			await tokenizer.ignore(30);
 			// Search for header should be in first 1KB of file.
 			while (tokenizer.position + 24 < tokenizer.fileInfo.size) {
+				const previousPosition = tokenizer.position;
 				const header = await readHeader();
 				let payload = header.size - 24;
 				if (_check(header.id, [0x91, 0x07, 0xDC, 0xB7, 0xB7, 0xA9, 0xCF, 0x11, 0x8E, 0xE6, 0x00, 0xC0, 0x0C, 0x20, 0x53, 0x65])) {
@@ -1442,6 +1443,11 @@ export class FileTypeParser {
 				}
 
 				await tokenizer.ignore(payload);
+
+				// Safeguard against malformed files: break if the position did not advance.
+				if (tokenizer.position <= previousPosition) {
+					break;
+				}
 			}
 
 			// Default to ASF generic extension

@@ -1022,6 +1022,16 @@ test('stringToBytes encodes correctly for selected characters and encodings', t
 	t.is(new TextDecoder('utf-16be').decode(new Uint8Array(stringToBytes('🦄', 'utf-16be'))), '🦄', 'Decoded value should match original value');
 });
 
+test('Does not hang on crafted ASF file with zero-size sub-header', async t => {
+	const buffer = Buffer.from('3026b2758e66cf11a6d9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 'hex');
+	const type = await fileTypeFromBuffer(buffer);
+
+	t.deepEqual(type, {
+		ext: 'asf',
+		mime: 'application/vnd.ms-asf',
+	});
+});
+
 test('Does not crash or hang if provided with a partial gunzip file', async t => {
 	const buffer = Uint8Array.from([31, 139, 8, 8, 137, 83, 29, 82, 0, 11]);
 	const type = await fileTypeFromBuffer(buffer);