diff options
| author | Anton Khirnov <anton@khirnov.net> | 2012-03-31 07:52:42 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2012-04-01 19:30:21 +0200 |
| commit | 989431c02ffcfdeb210cf42765e820130eb4b255 (patch) | |
| tree | 182d6ddc736cff91b647c9fa67b1b003cb7d97f8 /libavformat | |
| parent | 5effcfa76792470677a1f6bc9aa73347a87ef720 (diff) | |
| download | ffmpeg-989431c02ffcfdeb210cf42765e820130eb4b255.tar.gz | |
id3v2: fix skipping extended header in id3v2.4
In v2.4, the length includes the length field itself.
(cherry picked from commit ddb4431208745ea270dce8fce4cba999f0ed4303)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/id3v2.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index deb652d60c..6499872947 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -448,8 +448,17 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t unsync = flags & 0x80; - if (isv34 && flags & 0x40) /* Extended header present, just skip over it */ - avio_skip(s->pb, get_size(s->pb, 4)); + if (isv34 && flags & 0x40) { /* Extended header present, just skip over it */ + int extlen = get_size(s->pb, 4); + if (version == 4) + extlen -= 4; // in v2.4 the length includes the length field we just read + + if (extlen < 0) { + reason = "invalid extended header length"; + goto error; + } + avio_skip(s->pb, extlen); + } while (len >= taghdrlen) { unsigned int tflags = 0; |