Revision c5f4c0fd

View differences:

libavformat/id3v2.c
237 237 
            tag[3] = 0;
238 238 
            tlen = avio_rb24(s->pb);
239 239 
        }
240 
        len -= taghdrlen + tlen;
241 

  		




  242
  
  
    
        if (len < 0)


  		




  
  240
  
    
        if (tlen < 0 || tlen > len - taghdrlen) {


  		




  
  241
  
    
            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);


  		




  243
  242
  
    
            break;


  		




  244
  
  
    

  		




  
  243
  
    
        }


  		




  
  244
  
    
        len -= taghdrlen + tlen;


  		




  245
  245
  
    
        next = avio_tell(s->pb) + tlen;


  		




  246
  246
  
    

  		




  247
  247
  
    
        if (tflags & ID3v2_FLAG_DATALEN) {


  		












Also available in:  Unified diff