diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-29 05:00:52 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-29 05:01:38 +0100 |
| commit | 24cfe91a220204e56394c85bca51799b77df175b (patch) | |
| tree | 7c39542eb3ad29663c369962cc9e953022a357e7 /libavformat/id3v2.c | |
| parent | aa28c42534383ae1e2055d66a49c009e8234d18f (diff) | |
id3v2: allocate large enough buffer
Fixes array overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/id3v2.c')
| -rw-r--r-- | libavformat/id3v2.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 3e347d1e77..989ebf2a05 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -489,7 +489,8 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag goto fail; } - apic->buf = av_buffer_alloc(taglen); + apic->buf = av_buffer_alloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE); + apic->buf->size -= FF_INPUT_BUFFER_PADDING_SIZE; if (!apic->buf || !taglen || avio_read(pb, apic->buf->data, taglen) != taglen) goto fail; |