Merge remote-tracking branch 'qatar/master'

* qatar/master: (29 commits)
  ARM: disable ff_vector_fmul_vfp on VFPv3 systems
  ARM: check for VFPv3
  swscale: Remove unused variables in x86 code.
  doc: Drop DJGPP section, Libav now compiles out-of-the-box on FreeDOS.
  x86: Add appropriate ifdefs around certain AVX functions.
  cmdutils: use sws_freeContext() instead of av_freep().
  swscale: delay allocation of formatConvBuffer().
  swscale: fix build with --disable-swscale-alpha.
  movenc: Deprecate the global RTP hinting flag, use a private AVOption instead
  movenc: Add an AVClass for setting muxer specific options
  swscale: fix non-bitexact yuv2yuv[X2]() MMX/MMX2 functions.
  configure: report yasm/nasm presence properly
  tcp: make connect() timeout properly
  rawdec: factor video demuxer definitions into a macro.
  rtspdec: add initial_pause private option.
  lavf: deprecate AVFormatParameters.width/height.
  tty: add video_size private option.
  rawdec: add video_size private option.
  x11grab: add video_size private option.
  x11grab: factorize returning error codes.
  ...

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 7 insertions, 2 deletions

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 3640b11ab1..4e0c7d47ce 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -228,7 +228,7 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
         avio_skip(s->pb, get_size(s->pb, 4));
 
     while (len >= taghdrlen) {
-        unsigned int tflags;
+        unsigned int tflags = 0;
         int tunsync = 0;
 
         if (isv34) {
@@ -245,7 +245,7 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             tag[3] = 0;
             tlen = avio_rb24(s->pb);
         }
-        if (tlen > (1<<28))
+        if (tlen > (1<<28) || !tlen)
             break;
         len -= taghdrlen + tlen;
 
@@ -268,6 +268,10 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             if (unsync || tunsync) {
                 int i, j;
                 av_fast_malloc(&buffer, &buffer_size, tlen);
+                if (!buffer) {
+                    av_log(s, AV_LOG_ERROR, "Failed to alloc %d bytes\n", tlen);
+                    goto seek;
+                }
                 for (i = 0, j = 0; i < tlen; i++, j++) {
                     buffer[j] = avio_r8(s->pb);
                     if (j > 0 && !buffer[j] && buffer[j - 1] == 0xff) {
@@ -288,6 +292,7 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             break;
         }
         /* Skip to end of tag */
+seek:
         avio_seek(s->pb, next, SEEK_SET);
     }