diff options
| author | Piotr Bandurski <ami_stuff@o2.pl> | 2012-05-19 20:58:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-20 16:29:08 +0200 |
| commit | 4d18f4c15be1b338d30c236d8065d4cac75ceed1 (patch) | |
| tree | 4537a3226d5966ee8f4aa02811185e1d82b0fc60 | |
| parent | cb7b0f3573f392d1c340ea7d0b78f58d8dd07b4a (diff) | |
| download | ffmpeg-4d18f4c15be1b338d30c236d8065d4cac75ceed1.tar.gz | |
id3v2: reject APICs with size of 0
fixes ticket #1324
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/id3v2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 3b02d2b5b4..216d4a2e57 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -488,7 +488,7 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag apic->len = taglen; apic->data = av_malloc(taglen); - if (!apic->data || avio_read(pb, apic->data, taglen) != taglen) + if (!apic->data || !apic->len || avio_read(pb, apic->data, taglen) != taglen) goto fail; new_extra->tag = "APIC"; |