Permalink
Browse files

id3v2: check index against buffer size. Fix out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
  • Loading branch information...
1 parent 0b14c19 commit 10416a4d56fa8a89784e4fb62099c3cab17a9952 @michaelni michaelni committed Nov 29, 2012
Showing with 2 additions and 2 deletions.
  1. +2 −2 libavformat/id3v2.c
View
@@ -704,9 +704,9 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
uint8_t *b;
b = buffer;
- while (avio_tell(s->pb) < end) {
+ while (avio_tell(s->pb) < end && b - buffer < tlen) {
*b++ = avio_r8(s->pb);
- if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
+ if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && b - buffer < tlen) {
uint8_t val = avio_r8(s->pb);
*b++ = val ? val : avio_r8(s->pb);
}

0 comments on commit 10416a4

Please sign in to comment.