Commit 9ae80e6a authored by Anton Khirnov's avatar Anton Khirnov

id3v2: fix reading unsynchronized frames.

Current code would incorrectly process e.g. 'ff 00 ff 00 ff' to
'ff ff ff', while it should be 'ff ff 00 ff'.

Fixes Bug 395.

CC: libav-stable@libav.org
parent 0d312366
...@@ -617,21 +617,23 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t ...@@ -617,21 +617,23 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
/* check for text tag or supported special meta tag */ /* check for text tag or supported special meta tag */
} else if (tag[0] == 'T' || (extra_meta && (extra_func = get_extra_meta_func(tag, isv34)))) { } else if (tag[0] == 'T' || (extra_meta && (extra_func = get_extra_meta_func(tag, isv34)))) {
if (unsync || tunsync) { if (unsync || tunsync) {
int i, j; int64_t end = avio_tell(s->pb) + tlen;
uint8_t *b;
av_fast_malloc(&buffer, &buffer_size, tlen); av_fast_malloc(&buffer, &buffer_size, tlen);
if (!buffer) { if (!buffer) {
av_log(s, AV_LOG_ERROR, "Failed to alloc %d bytes\n", tlen); av_log(s, AV_LOG_ERROR, "Failed to alloc %d bytes\n", tlen);
goto seek; goto seek;
} }
for (i = 0, j = 0; i < tlen; i++, j++) { b = buffer;
buffer[j] = avio_r8(s->pb); while (avio_tell(s->pb) < end) {
if (j > 0 && !buffer[j] && buffer[j - 1] == 0xff) { *b++ = avio_r8(s->pb);
/* Unsynchronised byte, skip it */ if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
j--; uint8_t val = avio_r8(s->pb);
*b++ = val ? val : avio_r8(s->pb);
} }
} }
ffio_init_context(&pb, buffer, j, 0, NULL, NULL, NULL, NULL); ffio_init_context(&pb, buffer, b - buffer, 0, NULL, NULL, NULL, NULL);
tlen = j; tlen = b - buffer;
pbx = &pb; // read from sync buffer pbx = &pb; // read from sync buffer
} else { } else {
pbx = s->pb; // read straight from input pbx = s->pb; // read straight from input
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment