Revision c5f4c0fd
libavformat/id3v2.c | ||
---|---|---|
237 | 237 |
tag[3] = 0; |
238 | 238 |
tlen = avio_rb24(s->pb); |
239 | 239 |
} |
240 |
len -= taghdrlen + tlen; |
|
241 |
|
|
242 |
if (len < 0) |
|
240 |
if (tlen < 0 || tlen > len - taghdrlen) { |
|
241 |
av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag); |
|
243 | 242 |
break; |
244 |
|
|
243 |
} |
|
244 |
len -= taghdrlen + tlen; |
|
245 | 245 |
next = avio_tell(s->pb) + tlen; |
246 | 246 |
|
247 | 247 |
if (tflags & ID3v2_FLAG_DATALEN) { |
Also available in: Unified diff