From 24cfe91a220204e56394c85bca51799b77df175b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 29 Mar 2013 05:00:52 +0100 Subject: [PATCH] id3v2: allocate large enough buffer Fixes array overread Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/id3v2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 3e347d1e77..989ebf2a05 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -489,7 +489,8 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag goto fail; } - apic->buf = av_buffer_alloc(taglen); + apic->buf = av_buffer_alloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE); + apic->buf->size -= FF_INPUT_BUFFER_PADDING_SIZE; if (!apic->buf || !taglen || avio_read(pb, apic->buf->data, taglen) != taglen) goto fail;