Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Be more careful when parsing Vorbis Comments

  • Loading branch information...
commit b3646a07348ffa276ea41a9dae03ddc63ea6c532 1 parent 8ed9b0d
Frank Lai authored lalinsky committed
Showing with 13 additions and 3 deletions.
  1. +13 −3 taglib/ogg/xiphcomment.cpp
16 taglib/ogg/xiphcomment.cpp
View
@@ -295,21 +295,31 @@ void Ogg::XiphComment::parse(const ByteVector &data)
// Next the number of fields in the comment vector.
- int commentFields = data.mid(pos, 4).toUInt(false);
+ uint commentFields = data.mid(pos, 4).toUInt(false);
pos += 4;
- for(int i = 0; i < commentFields; i++) {
+ if(commentFields > (data.size() - 8) / 4) {
+ return;
+ }
+
+ for(uint i = 0; i < commentFields; i++) {
// Each comment field is in the format "KEY=value" in a UTF8 string and has
// 4 bytes before the text starts that gives the length.
- int commentLength = data.mid(pos, 4).toUInt(false);
+ uint commentLength = data.mid(pos, 4).toUInt(false);
pos += 4;
String comment = String(data.mid(pos, commentLength), String::UTF8);
pos += commentLength;
+ if(pos > data.size()) {
+ break;
+ }
int commentSeparatorPosition = comment.find("=");
+ if(commentSeparatorPosition == -1) {
+ break;
+ }
String key = comment.substr(0, commentSeparatorPosition);
String value = comment.substr(commentSeparatorPosition + 1);
Please sign in to comment.
Something went wrong with that request. Please try again.