Commit dd7453a2 authored by Adrian Drzewiecki's avatar Adrian Drzewiecki Committed by Michael Niedermayer

Fix id3v2 extended header handling.

When skipping over the extended header, take into account
that the size field has already been read. The extended header
also takes up space, so adjust total header length accordingly.
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 18abf46b
...@@ -456,8 +456,22 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t ...@@ -456,8 +456,22 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
unsync = flags & 0x80; unsync = flags & 0x80;
if (isv34 && flags & 0x40) /* Extended header present, just skip over it */ /* Extended header present, just skip over it */
avio_skip(s->pb, get_size(s->pb, 4)); if (isv34 && flags & 0x40) {
int size = get_size(s->pb, 4);
if (size < 6) {
reason = "extended header too short.";
goto error;
}
len -= size;
if (len < 0) {
reason = "extended header too long.";
goto error;
}
/* already seeked past size, skip the reset */
size -= 4;
avio_skip(s->pb, size);
}
while (len >= taghdrlen) { while (len >= taghdrlen) {
unsigned int tflags = 0; unsigned int tflags = 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment