ape: check the tag size (fixes integer underflow)

The expression "tagLen - size > 0" may result in an integer underflow
and a buffer overflow, when "size" is larger than "tagLen".  "size" is
read from the input file, and must not be trusted.  This patch changes
the expression to "tagLen > size", which is a lot safer.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/tag_ape.c b/src/tag_ape.c
index d1249fcb..0d504dc7 100644
--- a/src/tag_ape.c
+++ b/src/tag_ape.c
@@ -112,7 +112,7 @@ tag_ape_load(const char *file)
 
 		/* get the key */
 		key = p;
-		while (tagLen - size > 0 && *p != '\0') {
+		while (tagLen > size && *p != '\0') {
 			p++;
 			tagLen--;
 		}