From ac533ac458b8c75ac68372b34d0ce7c150684585 Mon Sep 17 00:00:00 2001 From: Carl Eugen Hoyos Date: Mon, 7 Mar 2011 23:18:36 +0100 Subject: [PATCH] Do not loop endlessly if id3v2 tag size is negative / too large. Fixes the sample from issue 2649. --- libavformat/id3v2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 7635735195..37443a4174 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -138,7 +138,8 @@ static void read_ttag(AVFormatContext *s, AVIOContext *pb, int taglen, const cha static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t flags) { - int isv34, tlen, unsync; + int isv34, unsync; + unsigned tlen; char tag[5]; int64_t next; int taghdrlen; @@ -191,6 +192,8 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t tag[3] = 0; tlen = avio_rb24(s->pb); } + if (tlen > (1<<28)) + break; len -= taghdrlen + tlen; if (len < 0) -- 2.11.0