From: Carl Eugen Hoyos <cehoyos@ag.or.at>
Date: Mon, 7 Mar 2011 22:18:36 +0000 (+0100)
Subject: Do not loop endlessly if id3v2 tag size is negative / too large.
X-Git-Tag: android-x86-4.4-r1~18242
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=ac533ac458b8c75ac68372b34d0ce7c150684585;p=android-x86%2Fexternal-ffmpeg.git

Do not loop endlessly if id3v2 tag size is negative / too large.

Fixes the sample from issue 2649.
---

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 7635735195..37443a4174 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -138,7 +138,8 @@ static void read_ttag(AVFormatContext *s, AVIOContext *pb, int taglen, const cha
 
 static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t flags)
 {
-    int isv34, tlen, unsync;
+    int isv34, unsync;
+    unsigned tlen;
     char tag[5];
     int64_t next;
     int taghdrlen;
@@ -191,6 +192,8 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             tag[3] = 0;
             tlen = avio_rb24(s->pb);
         }
+        if (tlen > (1<<28))
+            break;
         len -= taghdrlen + tlen;
 
         if (len < 0)