diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-05-01 19:01:11 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-07 07:13:55 +0200 |
| commit | f4bb72d33db2f12a3b4666c6843479d718ceecaf (patch) | |
| tree | a9f21c1286c2c626f15f457fe87ffc6b90fc3f77 | |
| parent | 6742f0408dba780e6a4fb266625f4542f6bd78d0 (diff) | |
| download | ffmpeg-f4bb72d33db2f12a3b4666c6843479d718ceecaf.tar.gz | |
id3v2: check for end of file while unescaping tags
Prevent an out of buffer bound write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c7a56ecfd84c264aa2b325020418472)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavformat/id3v2.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index a7d3549e17..f69ac034ff 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -510,9 +510,10 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t goto seek; } b = buffer; - while (avio_tell(s->pb) < end) { + while (avio_tell(s->pb) < end && !s->pb->eof_reached) { *b++ = avio_r8(s->pb); - if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) { + if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && + !s->pb->eof_reached ) { uint8_t val = avio_r8(s->pb); *b++ = val ? val : avio_r8(s->pb); } |