[FFmpeg-cvslog] id3v2: check for end of file while unescaping tags
Luca Barbato
git at videolan.org
Sun May 12 14:30:25 CEST 2013
ffmpeg | branch: release/1.1 | Luca Barbato <lu_zero at gentoo.org> | Wed May 1 19:01:11 2013 +0200| [5aac0811100ee5db9d03d7488b69cc321854da70] | committer: Luca Barbato
id3v2: check for end of file while unescaping tags
Prevent an out of buffer bound write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable at libav.org
(cherry picked from commit af4cc2605c7a56ecfd84c264aa2b325020418472)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5aac0811100ee5db9d03d7488b69cc321854da70
---
libavformat/id3v2.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 7f39a47..5cc17c4 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -626,9 +626,10 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
goto seek;
}
b = buffer;
- while (avio_tell(s->pb) < end) {
+ while (avio_tell(s->pb) < end && !s->pb->eof_reached) {
*b++ = avio_r8(s->pb);
- if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
+ if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 &&
+ !s->pb->eof_reached ) {
uint8_t val = avio_r8(s->pb);
*b++ = val ? val : avio_r8(s->pb);
}
More information about the ffmpeg-cvslog
mailing list