diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-04-12 20:31:43 +0100 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-04-12 20:31:43 +0100 |
| commit | b283b2b640024cff685dd019e9df992d31aebeab (patch) | |
| tree | 3fa9fd355e891cda075e558cdaa8366a052a3039 /src | |
| parent | 065344253a1c3c8ddbbfb673712e9a11656f29bc (diff) | |
| parent | 27f977bbfde5a35481e9e564864fdf4cff27807d (diff) | |
| download | xine-lib-b283b2b640024cff685dd019e9df992d31aebeab.tar.gz xine-lib-b283b2b640024cff685dd019e9df992d31aebeab.tar.bz2 | |
Merge from 1.1.
Diffstat (limited to 'src')
| -rw-r--r-- | src/demuxers/id3.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/src/demuxers/id3.c b/src/demuxers/id3.c index 1919239e6..6ca05aa86 100644 --- a/src/demuxers/id3.c +++ b/src/demuxers/id3.c @@ -273,9 +273,12 @@ static int id3v22_parse_frame_header(input_plugin_t *input, static int id3v22_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v22_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; - + if (input->read (input, buf, frame_header->size) == frame_header->size) { buf[frame_header->size] = 0; buf[frame_header->size + 1] = 0; @@ -460,7 +463,10 @@ static int id3v23_parse_frame_ext_header(input_plugin_t *input, static int id3v23_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v23_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; if (input->read (input, buf, frame_header->size) == frame_header->size) { @@ -704,7 +710,10 @@ static int id3v24_parse_ext_header(input_plugin_t *input, static int id3v24_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v24_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; if (input->read (input, buf, frame_header->size) == frame_header->size) { |