diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-02 02:25:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-02 02:25:49 +0200 |
| commit | 0fda37cff9470c602fd59366ac4250a9a4eae6b1 (patch) | |
| tree | 6ef48a53c6a992abbd7a68d10a4751e2bafa95ab | |
| parent | 8e101086ebbf73f6ef0756ace3e1b42ecbb1eff2 (diff) | |
| parent | 2e693be7e9b1a70360dd6849a58fae74b16afba1 (diff) | |
| download | ffmpeg-0fda37cff9470c602fd59366ac4250a9a4eae6b1.tar.gz | |
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5
* qatar/release/0.5:
id3v2: fix skipping extended header in id3v2.4
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mp3.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/libavformat/mp3.c b/libavformat/mp3.c index fa383d6512..ca414082ea 100644 --- a/libavformat/mp3.c +++ b/libavformat/mp3.c @@ -246,8 +246,17 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t fl goto error; } - if(isv34 && flags & 0x40) /* Extended header present, just skip over it */ - url_fskip(s->pb, id3v2_get_size(s->pb, 4)); + if (isv34 && flags & 0x40) { /* Extended header present, just skip over it */ + int extlen = id3v2_get_size(s->pb, 4); + if (version == 4) + extlen -= 4; // in v2.4 the length includes the length field we just read + + if (extlen < 0) { + reason = "invalid extended header length"; + goto error; + } + url_fskip(s->pb, extlen); + } while(len >= taghdrlen) { if(isv34) { |