[FFmpeg-cvslog] id3v2: check index against buffer size. Fix out of array access

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Nov 29 22:57:39 2012 +0100| [10416a4d56fa8a89784e4fb62099c3cab17a9952] | committer: Michael Niedermayer

id3v2: check index against buffer size. Fix out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=10416a4d56fa8a89784e4fb62099c3cab17a9952
---

 libavformat/id3v2.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index c6f88ec..f805f5b 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -704,9 +704,9 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
                 uint8_t *b;
 
                 b = buffer;
-                while (avio_tell(s->pb) < end) {
+                while (avio_tell(s->pb) < end && b - buffer < tlen) {
                     *b++ = avio_r8(s->pb);
-                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1) {
+                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && b - buffer < tlen) {
                         uint8_t val = avio_r8(s->pb);
                         *b++ = val ? val : avio_r8(s->pb);
                     }