RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

id3v2: check for end of file while unescaping tags 

Prevent a serious out of buffer bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-05-01 19:01:11 +02:00
parent 76d23f4031
commit af4cc2605c
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/id3v2.c
View File

@ -644,9 +644,10 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
goto seek; goto seek;
} }
b = buffer; b = buffer;
while (avio_tell(s->pb) < end) { while (avio_tell(s->pb) < end && !s->pb->eof_reached) {
*b++ = avio_r8(s->pb); *b++ = avio_r8(s->pb);
if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) { if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 &&
!s->pb->eof_reached ) {
uint8_t val = avio_r8(s->pb); uint8_t val = avio_r8(s->pb);
*b++ = val ? val : avio_r8(s->pb); *b++ = val ? val : avio_r8(s->pb);
} }