shithub: libtags

Info  •  Files  •  Log  •  Branches

[PATCH libtags] flac: handle vorbis comments with no fields

In this case, sz is exactly vensz+4, and numtags is 0.

Also, subtract vensz from sz after we skip past it so that the
subsequent range checks are correct.

--- a/flac.c

+++ b/flac.c

@@ -64,12 +64,12 @@

 			sz -= 4;

 			vensz = leuint(d);

-			if(vensz < 0 || vensz > sz-8)

+			if(vensz < 0 || vensz > sz-4)

 				return -1;

 			/* skip vendor, read the number of tags */

 			if(ctx->seek(ctx, vensz, 1) < 0 || ctx->read(ctx, d, 4) != 4)

 				return -1;

-			sz -= 4;

+			sz -= vensz + 4;

 			numtags = leuint(d);

 			for(i = 0; i < numtags && sz > 4; i++){