AIKIDO-2026-10374

TL;DR

The ASF (WMA) parser in lib/asf/AsfParser.ts uses a loop in parseObjectHeader that reads object headers and advances by remaining bytes. When a file supplies an invalid header object size, remaining can become negative; the code did not validate it and the loop could run indefinitely, causing denial of service. The patch adds an explicit check for remaining < 0 and throws AsfContentParseError, and removes the try/catch that previously swallowed parsing errors, so invalid input is rejected instead of hanging.