diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/demuxers/id3.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/src/demuxers/id3.c b/src/demuxers/id3.c index 1919239e6..6ca05aa86 100644 --- a/src/demuxers/id3.c +++ b/src/demuxers/id3.c @@ -273,9 +273,12 @@ static int id3v22_parse_frame_header(input_plugin_t *input, static int id3v22_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v22_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; - + if (input->read (input, buf, frame_header->size) == frame_header->size) { buf[frame_header->size] = 0; buf[frame_header->size + 1] = 0; @@ -460,7 +463,10 @@ static int id3v23_parse_frame_ext_header(input_plugin_t *input, static int id3v23_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v23_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; if (input->read (input, buf, frame_header->size) == frame_header->size) { @@ -704,7 +710,10 @@ static int id3v24_parse_ext_header(input_plugin_t *input, static int id3v24_interp_frame(input_plugin_t *input, xine_stream_t *stream, id3v24_frame_header_t *frame_header) { - char buf[frame_header->size + 2]; + const size_t bufsize = frame_header->size + 2; + if ( bufsize < 3 ) /* frames has to be _at least_ 1 byte */ + return 0; + char buf[bufsize]; int enc; if (input->read (input, buf, frame_header->size) == frame_header->size) { |