clamping beat length

CHANGELOG.md

@@ -4,6 +4,7 @@
 - fruits: Fixed droplet timings on juicestreams with span count >1
 - Fixed timing point parsing on some (older) maps where "uninherited" value did not coincide with beat length
 - Fixed handling .osu files with missing difficulty attributes
+- Fixed huge memory allocations caused by incorrectly parsed .osu files by clamping beat length
 - Added `AttributeProvider` impl for `{Mode}PerformanceAttributes`
 - [BREAKING] Store `HitObject::sound` in `Beatmap::sounds` instead to reduce the struct size
 - [BREAKING] Removed the mode features `osu`, `fruits`, `taiko`, and `mania`. Now all modes are always supported.

src/parse/mod.rs

@@ -283,6 +283,7 @@ macro_rules! parse_timingpoints_body {
             let timing_change = split.nth(4).and_then(|value| value.bytes().next());
 
             if matches!(timing_change, Some(b'1') | None) {
+                let beat_len = beat_len.clamp(6.0, 60_000.0);
                 $self.timing_points.push(TimingPoint { time, beat_len });
 
                 if time < prev_time {
@@ -292,7 +293,7 @@ macro_rules! parse_timingpoints_body {
                 }
             } else {
                 let speed_multiplier = if beat_len < 0.0 {
-                    (-100.0 / beat_len).max(0.1).min(10.0)
+                    (-100.0 / beat_len).clamp(0.1, 10.0)
                 } else {
                     1.0
                 };