[FFmpeg-devel] [PATCH] lavf/aiffdec: handle files with ID3 data larger than ID3 chunk size

[Matthieu Bouron]

---
 libavformat/aiffdec.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 8d466fa..b6a7946 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -193,6 +193,7 @@ static int aiff_read_header(AVFormatContext *s)
 {
     int ret, size, filesize;
     int64_t offset = 0;
+    int64_t tag_size, tag_offset;
     uint32_t tag;
     unsigned version = AIFF_C_VERSION1;
     AVIOContext *pb = s->pb;
@@ -236,6 +237,7 @@ static int aiff_read_header(AVFormatContext *s)
                 goto got_sound;
             break;
         case MKTAG('I', 'D', '3', ' '):
+            tag_offset = avio_tell(pb);
             ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta);
             if (id3v2_extra_meta)
                 if ((ret = ff_id3v2_parse_apic(s, &id3v2_extra_meta)) < 0) {
@@ -243,6 +245,11 @@ static int aiff_read_header(AVFormatContext *s)
                     return ret;
                 }
             ff_id3v2_free_extra_meta(&id3v2_extra_meta);
+            tag_size = avio_tell(pb) - tag_offset;
+            if (tag_size > size) {
+                av_log(s, AV_LOG_WARNING, "ID3 data is larger than ID3 chunk size\n");
+                avio_seek(pb, tag_size - size, SEEK_SET);
+            }
             break;
         case MKTAG('F', 'V', 'E', 'R'):     /* Version chunk */
             version = avio_rb32(pb);
-- 
1.8.0