Commit c5f4c0fd authored by Anton Khirnov's avatar Anton Khirnov Committed by Justin Ruggles
Browse files

id3v2: skip broken tags with invalid size

fixes issue2649.
parent 18854887
......@@ -237,11 +237,11 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
tag[3] = 0;
tlen = avio_rb24(s->pb);
}
len -= taghdrlen + tlen;
if (len < 0)
if (tlen < 0 || tlen > len - taghdrlen) {
av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);
break;
}
len -= taghdrlen + tlen;
next = avio_tell(s->pb) + tlen;
if (tflags & ID3v2_FLAG_DATALEN) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment