apetag: fix error handling in ff_ape_parse_tag()
authorXi Wang <xi.wang@gmail.com>
Wed, 14 Nov 2012 08:25:41 +0000 (03:25 -0500)
committerAnton Khirnov <anton@khirnov.net>
Wed, 21 Nov 2012 13:35:26 +0000 (14:35 +0100)
commitb655cfefafd565590bfc5976b9ce8dd141b3c41c
tree9deaab26b20f1fbc2e3e6e51eb6e3f80eaf46aa0
parent17fecb4a59926fc85d76efd0d0405f1aa84e429b
apetag: fix error handling in ff_ape_parse_tag()

The following error handling is broken due to signedness.

    int file_size;
    uint32_t tag_bytes;
    int64_t tag_start;
    ...
    tag_start = file_size - tag_bytes - APE_TAG_FOOTER_BYTES;
    if (tag_start < 0) { ... }

Note that tag_bytes is unsigned, which makes the right-hand side of
`tag_start = ...' unsigned, too.  The 32-bit unsigned value is then
zero-extended to 64 bits.  Therefore, tag_start must be non-negative,
and the check (tag_start < 0) is always false, which breaks the error
handling.  This patch fixes the check.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
libavformat/apetag.c