diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-02 02:19:06 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-02 02:19:17 +0200 |
| commit | 113ca1b8db8f4b76568e40cadfd314d6ab64623c (patch) | |
| tree | 2fb4158b12062cf6349a9ad7fd17f5ef33425691 | |
| parent | 1014e20492d529ba165227a5376d9199a4e24175 (diff) | |
| parent | f70c720d42d0e222b70fc580a36832a7b0ef89fa (diff) | |
| download | ffmpeg-113ca1b8db8f4b76568e40cadfd314d6ab64623c.tar.gz | |
Merge remote-tracking branch 'qatar/release/0.6' into release/0.6
* qatar/release/0.6:
id3v2: fix skipping extended header in id3v2.4
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/id3v2.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 6fa11db6c0..8c1c0710e7 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -187,8 +187,17 @@ void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t flags) goto error; } - if (isv34 && flags & 0x40) /* Extended header present, just skip over it */ - url_fskip(s->pb, get_size(s->pb, 4)); + if (isv34 && flags & 0x40) { /* Extended header present, just skip over it */ + int extlen = get_size(s->pb, 4); + if (version == 4) + extlen -= 4; // in v2.4 the length includes the length field we just read + + if (extlen < 0) { + reason = "invalid extended header length"; + goto error; + } + url_fskip(s->pb, extlen); + } while (len >= taghdrlen) { if (isv34) { |