Revision c5f4c0fd libavformat/id3v2.c

View differences:

libavformat/id3v2.c
237 237
            tag[3] = 0;
238 238
            tlen = avio_rb24(s->pb);
239 239
        }
240
        len -= taghdrlen + tlen;
241

  
242
        if (len < 0)
240
        if (tlen < 0 || tlen > len - taghdrlen) {
241
            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);
243 242
            break;
244

  
243
        }
244
        len -= taghdrlen + tlen;
245 245
        next = avio_tell(s->pb) + tlen;
246 246

  
247 247
        if (tflags & ID3v2_FLAG_DATALEN) {

Also available in: Unified diff