Module: libav Branch: release/9 Commit: 5aac0811100ee5db9d03d7488b69cc321854da70
Author: Luca Barbato <[email protected]> Committer: Luca Barbato <[email protected]> Date: Wed May 1 19:01:11 2013 +0200 id3v2: check for end of file while unescaping tags Prevent an out of buffer bound write. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:[email protected] (cherry picked from commit af4cc2605c7a56ecfd84c264aa2b325020418472) Signed-off-by: Luca Barbato <[email protected]> --- libavformat/id3v2.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 7f39a47..5cc17c4 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -626,9 +626,10 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t goto seek; } b = buffer; - while (avio_tell(s->pb) < end) { + while (avio_tell(s->pb) < end && !s->pb->eof_reached) { *b++ = avio_r8(s->pb); - if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) { + if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && + !s->pb->eof_reached ) { uint8_t val = avio_r8(s->pb); *b++ = val ? val : avio_r8(s->pb); } _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
