diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2008-07-04 22:04:41 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2008-07-04 22:04:41 +0000 |
| commit | 03289958938e91dc9bc398fdf1489677c6030063 (patch) | |
| tree | 4c3673aa7af7f9cc256cdf7283d225f682e116c6 | |
| parent | d5ae45841f92951340f65ebd5eafdae136e1d6bb (diff) | |
| download | ffmpeg-03289958938e91dc9bc398fdf1489677c6030063.tar.gz | |
All mp3 parsers are buggy fix 2 of n (out of array write, i suspect not exploitable)
Originally committed as revision 14070 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/mp3.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mp3.c b/libavformat/mp3.c index 6d9689a649..e987904f6a 100644 --- a/libavformat/mp3.c +++ b/libavformat/mp3.c @@ -205,7 +205,7 @@ static void id3v2_read_ttag(AVFormatContext *s, int taglen, char *dst, int dstle break; case 3: /* UTF-8 */ - len = FFMIN(taglen, dstlen); + len = FFMIN(taglen, dstlen-1); get_buffer(s->pb, dst, len); dst[len] = 0; break; |