diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-29 22:57:39 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-29 23:12:42 +0100 |
| commit | 10416a4d56fa8a89784e4fb62099c3cab17a9952 (patch) | |
| tree | fa2dd59798e709f0dbebe323f9345183acef5207 | |
| parent | 0b14c197f1fffb4fe435e8107c903a3ab53c9557 (diff) | |
| download | ffmpeg-10416a4d56fa8a89784e4fb62099c3cab17a9952.tar.gz | |
id3v2: check index against buffer size. Fix out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/id3v2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index c6f88ec24c..f805f5bac2 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -704,9 +704,9 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t uint8_t *b; b = buffer; - while (avio_tell(s->pb) < end) { + while (avio_tell(s->pb) < end && b - buffer < tlen) { *b++ = avio_r8(s->pb); - if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) { + if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && b - buffer < tlen) { uint8_t val = avio_r8(s->pb); *b++ = val ? val : avio_r8(s->pb); } |