[FFmpeg-cvslog] id3v2: allocate large enough buffer

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Mar 29 05:00:52 2013 +0100| [24cfe91a220204e56394c85bca51799b77df175b] | committer: Michael Niedermayer

id3v2: allocate large enough buffer

Fixes array overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24cfe91a220204e56394c85bca51799b77df175b
---

 libavformat/id3v2.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 3e347d1..989ebf2 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -489,7 +489,8 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag
         goto fail;
     }
 
-    apic->buf = av_buffer_alloc(taglen);
+    apic->buf = av_buffer_alloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE);
+    apic->buf->size -= FF_INPUT_BUFFER_PADDING_SIZE;
     if (!apic->buf || !taglen || avio_read(pb, apic->buf->data, taglen) != taglen)
         goto fail;