id3v2: skip broken tags with invalid size
authorAnton Khirnov <anton@khirnov.net>
Tue, 22 Mar 2011 09:35:35 +0000 (10:35 +0100)
committerJustin Ruggles <justin.ruggles@gmail.com>
Tue, 22 Mar 2011 13:08:59 +0000 (09:08 -0400)
fixes issue2649.

libavformat/id3v2.c

index 96f3e1c..4fecffe 100644 (file)
@@ -237,11 +237,11 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             tag[3] = 0;
             tlen = avio_rb24(s->pb);
         }
-        len -= taghdrlen + tlen;
-
-        if (len < 0)
+        if (tlen < 0 || tlen > len - taghdrlen) {
+            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);
             break;
-
+        }
+        len -= taghdrlen + tlen;
         next = avio_tell(s->pb) + tlen;
 
         if (tflags & ID3v2_FLAG_DATALEN) {