shithub: libtags

Info  •  Files  •  Log  •  Branches

id3v2: deal with invalid text tag sizes

--- a/id3v2.c

+++ b/id3v2.c

@@ -214,7 +214,9 @@

 {

 	char *b, *tag;

-	if(ctx->bufsz >= tsz+1){

+	if(tsz < 0)

+		return -1;

+	if(ctx->bufsz > tsz){

 		/* place the data at the end to make best effort at charset conversion */

 		tag = &ctx->buf[ctx->bufsz - tsz - 1];

 		if(ctx->read(ctx, tag, tsz) != tsz)