shithub: mp3dec

Info  •  Files  •  Log  •  Branches

fix negative size memcpy in L3_restore_reservoir found by afl

--- a/minimp3.h

+++ b/minimp3.h

@@ -1675,7 +1675,7 @@

     if (info->layer == 3)

     {

         int main_data_begin = L3_read_side_info(bs_frame, scratch.gr_info, hdr);

-        if (main_data_begin < 0)

+        if (main_data_begin < 0 || bs_frame->pos > bs_frame->limit)

         {

             mp3dec_init(dec);

             return 0;