Commit 44a02408 authored by Fargier Sylvain's avatar Fargier Sylvain Committed by Rémi Duraffort

Fix out of range memory access when APIC frame type is out of the range...

Fix out of range memory access when APIC frame type is out of the range defined in the ID3v2 specification (corrupted tag or vendor defined).

Fix #4163.
Signed-off-by: default avatarFargier Sylvain <fargier.sylvain@free.fr>
Signed-off-by: default avatarRémi Duraffort <ivoire@videolan.org>
(cherry picked from commit 639c195b)
parent da8eaf2b
......@@ -199,6 +199,7 @@ static void ReadMetaFromId3v2( ID3v2::Tag* tag, demux_t* p_demux, demux_meta_t*
3, /* Logo of the band or performer. */
2 /* Logo of the publisher (record company). */
};
#define PI_COVER_SCORE_SIZE (sizeof (pi_cover_score) / sizeof (pi_cover_score[0]))
int i_score = -1;
// Try now to get embedded art
......@@ -260,9 +261,13 @@ static void ReadMetaFromId3v2( ID3v2::Tag* tag, demux_t* p_demux, demux_meta_t*
p_attachment );
free( psz_description );
if( pi_cover_score[p_apic->type()] > i_score )
unsigned i_pic_type = p_apic->type();
if( i_pic_type >= PI_COVER_SCORE_SIZE )
i_pic_type = 0; // Defaults to "Other"
if( pi_cover_score[i_pic_type] > i_score )
{
i_score = pi_cover_score[p_apic->type()];
i_score = pi_cover_score[i_pic_type];
char *psz_url;
if( asprintf( &psz_url, "attachment://%s",
p_attachment->psz_name ) == -1 )
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment