1 files changed, 26 insertions, 13 deletions

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index c30ab4ceb3..48124cee84 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -1,24 +1,31 @@
 /*
- * ID3v2 header parser
  * Copyright (c) 2003 Fabrice Bellard
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+/**
+ * @file
+ * ID3v2 header parser
+ *
+ * Specifications available at:
+ * http://id3.org/Developer_Information
+ */
+
 #include "id3v2.h"
 #include "id3v1.h"
 #include "libavutil/avstring.h"
@@ -62,8 +69,9 @@ static unsigned int get_size(AVIOContext *s, int len)
 /**
  * Free GEOB type extra metadata.
  */
-static void free_geobtag(ID3v2ExtraMetaGEOB *geob)
+static void free_geobtag(void *obj)
 {
+    ID3v2ExtraMetaGEOB *geob = obj;
     av_free(geob->mime_type);
     av_free(geob->file_name);
     av_free(geob->description);
@@ -337,12 +345,13 @@ static const ID3v2EMFunc *get_extra_meta_func(const char *tag, int isv34)
             return &ff_id3v2_extra_meta_funcs[i];
         i++;
     }
-    return NULL;
+    return &ff_id3v2_extra_meta_funcs[i];
 }
 
 static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t flags, ID3v2ExtraMeta **extra_meta)
 {
-    int isv34, tlen, unsync;
+    int isv34, unsync;
+    unsigned tlen;
     char tag[5];
     int64_t next, end = avio_tell(s->pb) + len;
     int taghdrlen;
@@ -397,11 +406,13 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
             tag[3] = 0;
             tlen = avio_rb24(s->pb);
         }
-        if (tlen < 0 || tlen > len - taghdrlen) {
-            av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);
+        if (tlen > (1<<28))
             break;
-        }
         len -= taghdrlen + tlen;
+
+        if (len < 0)
+            break;
+
         next = avio_tell(s->pb) + tlen;
 
         if (!tlen) {
@@ -411,6 +422,8 @@ static void ff_id3v2_parse(AVFormatContext *s, int len, uint8_t version, uint8_t
         }
 
         if (tflags & ID3v2_FLAG_DATALEN) {
+            if (tlen < 4)
+                break;
             avio_rb32(s->pb);
             tlen -= 4;
         }
@@ -508,7 +521,7 @@ void ff_id3v2_read(AVFormatContext *s, const char *magic)
 void ff_id3v2_free_extra_meta(ID3v2ExtraMeta **extra_meta)
 {
     ID3v2ExtraMeta *current = *extra_meta, *next;
-    void (*free_func)(ID3v2ExtraMeta*);
+    void (*free_func)(void *);
 
     while (current) {
         if ((free_func = get_extra_meta_func(current->tag, 1)->free))
@@ -521,7 +534,7 @@ void ff_id3v2_free_extra_meta(ID3v2ExtraMeta **extra_meta)
 
 const ID3v2EMFunc ff_id3v2_extra_meta_funcs[] = {
     { "GEO", "GEOB", read_geobtag, free_geobtag },
-    { NULL }
+    { NULL,  NULL,   NULL,         NULL }
 };
 
 const AVMetadataConv ff_id3v2_34_metadata_conv[] = {