[PATCH] make sure to get to the end of an id3v2 tag, even if =

[David Byron none]

something in the tag is bogus=0A=
=0A=
---=0A=
 libavformat/id3v2.c |   12 ++++++++++++=0A=
 1 files changed, 12 insertions(+), 0 deletions(-)=0A=
=0A=
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c=0A=
index 877e37d..d259159 100644=0A=
--- a/libavformat/id3v2.c=0A=
+++ b/libavformat/id3v2.c=0A=
@@ -171,6 +171,11 @@ void ff_id3v2_parse(AVFormatContext *s, int len, =
uint8_t version, uint8_t flags)=0A=
     ByteIOContext pb;=0A=
     unsigned char *buffer =3D NULL;=0A=
     int buffer_size =3D 0;=0A=
+    int64_t end_of_tag;=0A=
+=0A=
+    /* Figure out where the end of the tag is and make sure=0A=
+       we get there even if we find something bogus */=0A=
+    end_of_tag =3D len + url_ftell(s->pb);=0A=
 =0A=
     switch (version) {=0A=
     case 2:=0A=
@@ -219,7 +224,11 @@ void ff_id3v2_parse(AVFormatContext *s, int len, =
uint8_t version, uint8_t flags)=0A=
         len -=3D taghdrlen + tlen;=0A=
 =0A=
         if (len < 0)=0A=
+        {=0A=
+            av_log(s, AV_LOG_INFO, "\"%s\": bogus tag length: %d\n",=0A=
+                   s->filename, tlen);=0A=
             break;=0A=
+        }=0A=
 =0A=
         next =3D url_ftell(s->pb) + tlen;=0A=
 =0A=
@@ -257,6 +266,9 @@ void ff_id3v2_parse(AVFormatContext *s, int len, =
uint8_t version, uint8_t flags)=0A=
     if (version =3D=3D 4 && flags & 0x10) /* Footer preset, always 10 =
bytes, skip over it */=0A=
         url_fskip(s->pb, 10);=0A=
 =0A=
+    if (url_ftell(s->pb) !=3D end_of_tag)=0A=
+        url_fseek(s->pb, end_of_tag, SEEK_SET);=0A=
+=0A=
     av_free(buffer);=0A=
     return;=0A=
 =0A=
-- =0A=
1.6.0.4=0A=
=0A=

------=_NextPart_000_01F6_01CB4FF5.619493A0--