diff options
| author | Anton Khirnov <anton@khirnov.net> | 2011-03-22 10:35:35 +0100 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2011-03-22 09:08:59 -0400 |
| commit | c5f4c0fd5c791ba97eb266cc30ae2172c10feb20 (patch) | |
| tree | db18b056089c10221ebae5f025a8d0dfa23b8b8f | |
| parent | 1885488757dc4c6b2d275e4524ed6dd19e97f9b0 (diff) | |
| download | ffmpeg-c5f4c0fd5c791ba97eb266cc30ae2172c10feb20.tar.gz | |
id3v2: skip broken tags with invalid size
fixes issue2649.
| -rw-r--r-- | libavformat/id3v2.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 96f3e1c61a..4fecffe6ba 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -237,11 +237,11 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t tag[3] = 0; tlen = avio_rb24(s->pb); } - len -= taghdrlen + tlen; - - if (len < 0) + if (tlen < 0 || tlen > len - taghdrlen) { + av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag); break; - + } + len -= taghdrlen + tlen; next = avio_tell(s->pb) + tlen; if (tflags & ID3v2_FLAG_DATALEN) { |