| 
																	
																	
																		
																	
																	
																 | 
																@@ -401,13 +401,19 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t | 
															
														
														
													
														
															
																 | 
																 | 
																            tag[3] = 0; | 
																 | 
																 | 
																            tag[3] = 0; | 
															
														
														
													
														
															
																 | 
																 | 
																            tlen = avio_rb24(s->pb); | 
																 | 
																 | 
																            tlen = avio_rb24(s->pb); | 
															
														
														
													
														
															
																 | 
																 | 
																        } | 
																 | 
																 | 
																        } | 
															
														
														
													
														
															
																 | 
																 | 
																        if (tlen <= 0 || tlen > len - taghdrlen) { | 
																 | 
																 | 
																 | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																        if (tlen < 0 || tlen > len - taghdrlen) { | 
															
														
														
													
														
															
																 | 
																 | 
																            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag); | 
																 | 
																 | 
																            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag); | 
															
														
														
													
														
															
																 | 
																 | 
																            break; | 
																 | 
																 | 
																            break; | 
															
														
														
													
														
															
																 | 
																 | 
																        } | 
																 | 
																 | 
																        } | 
															
														
														
													
														
															
																 | 
																 | 
																        len -= taghdrlen + tlen; | 
																 | 
																 | 
																        len -= taghdrlen + tlen; | 
															
														
														
													
														
															
																 | 
																 | 
																        next = avio_tell(s->pb) + tlen; | 
																 | 
																 | 
																        next = avio_tell(s->pb) + tlen; | 
															
														
														
													
														
															
																 | 
																 | 
																
  | 
																 | 
																 | 
																
  | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																        if (!tlen) { | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																            if (tag[0]) | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																                av_log(s, AV_LOG_DEBUG, "Invalid empty frame %s, skipping.\n", tag); | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																            continue; | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																        } | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																
  | 
															
														
														
													
														
															
																 | 
																 | 
																        if (tflags & ID3v2_FLAG_DATALEN) { | 
																 | 
																 | 
																        if (tflags & ID3v2_FLAG_DATALEN) { | 
															
														
														
													
														
															
																 | 
																 | 
																            avio_rb32(s->pb); | 
																 | 
																 | 
																            avio_rb32(s->pb); | 
															
														
														
													
														
															
																 | 
																 | 
																            tlen -= 4; | 
																 | 
																 | 
																            tlen -= 4; | 
															
														
														
													
												
													
														
															
																| 
																	
																		
																	
																	
																	
																 | 
																
  |