1 files changed, 14 insertions, 5 deletions

diff --git a/src/demuxers/demux_flac.c b/src/demuxers/demux_flac.c
index b4c5427c5..ed974a69c 100644
--- a/src/demuxers/demux_flac.c
+++ b/src/demuxers/demux_flac.c
@@ -189,7 +189,7 @@ static int open_flac_file(demux_flac_t *flac) {
     case 4:
       lprintf ("VORBIS_COMMENT metadata\n");
       {
-        char comments[block_length];
+        char comments[block_length + 1]; /* last byte for NUL termination */
         char *ptr = comments;
         uint32_t length, user_comment_list_length, cn;
         char *comment;
@@ -201,18 +201,25 @@ static int open_flac_file(demux_flac_t *flac) {
 
           length = _X_LE_32(ptr);
           ptr += 4 + length;
+          if (length > block_length - 8)
+            return 0; /* bad length or too little left in the buffer */
 
           user_comment_list_length = _X_LE_32(ptr);
           ptr += 4;
 
           cn = 0;
           for (; cn < user_comment_list_length; cn++) {
+            if (ptr > comments + block_length - 4)
+              return 0; /* too little left in the buffer */
+
             length = _X_LE_32(ptr);
             ptr += 4;
+            if (length >= block_length || ptr + length > comments + block_length)
+              return 0; /* bad length */
 
             comment = (char*) ptr;
             c = comment[length];
-            comment[length] = 0;
+            comment[length] = 0; /* NUL termination */
 
             lprintf ("comment[%02d] = %s\n", cn, comment);
 
@@ -247,8 +254,8 @@ static int open_flac_file(demux_flac_t *flac) {
           }
 
           if ((tracknumber > 0) && (tracktotal > 0)) {
-            char tn[16];
-            snprintf (tn, 16, "%02d/%02d", tracknumber, tracktotal);
+            char tn[24];
+            snprintf (tn, 24, "%02d/%02d", tracknumber, tracktotal);
             _x_meta_info_set(flac->stream, XINE_META_INFO_TRACK_NUMBER, tn);
           }
           else if (tracknumber > 0) {
@@ -520,7 +527,9 @@ void *demux_flac_init_plugin (xine_t *xine, void *data) {
   this->demux_class.open_plugin     = open_plugin;
   this->demux_class.description     = N_("Free Lossless Audio Codec (flac) demux plugin");
   this->demux_class.identifier      = "FLAC";
-  this->demux_class.mimetypes       = NULL;
+  this->demux_class.mimetypes       =
+    "audio/x-flac: flac: FLAC Audio;"
+    "audio/flac: flac: FLAC Audio;";
   this->demux_class.extensions      = "flac";
   this->demux_class.dispose         = default_demux_class_dispose;