[FFmpeg-cvslog] id3v2: check for end of file while unescaping tags

[Luca Barbato]

ffmpeg | branch: release/0.10 | Luca Barbato <lu_zero at gentoo.org> | Wed May  1 19:01:11 2013 +0200| [f4bb72d33db2f12a3b4666c6843479d718ceecaf] | committer: Reinhard Tartler

id3v2: check for end of file while unescaping tags

Prevent an out of buffer bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable at libav.org
(cherry picked from commit af4cc2605c7a56ecfd84c264aa2b325020418472)

Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f4bb72d33db2f12a3b4666c6843479d718ceecaf
---

 libavformat/id3v2.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index a7d3549..f69ac03 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -510,9 +510,10 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
                     goto seek;
                 }
                 b = buffer;
-                while (avio_tell(s->pb) < end) {
+                while (avio_tell(s->pb) < end && !s->pb->eof_reached) {
                     *b++ = avio_r8(s->pb);
-                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
+                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 &&
+                        !s->pb->eof_reached ) {
                         uint8_t val = avio_r8(s->pb);
                         *b++ = val ? val : avio_r8(s->pb);
                     }