From 41da64d9270b2fa10c93ce74dea014fe8f0bd303 Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Sat, 5 Nov 2011 09:49:14 +1100 Subject: [PATCH] src/id3.c : Fix a stack overflow when parsing a file with multiple ID3 headers. --- ChangeLog | 8 ++++++++ src/id3.c | 11 ++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 380aa4c..3fe35fc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2011-11-05 Erik de Castro Lopo + + * src/id3.c + Fix a stack overflow that can occur when parsing a file with multiple + ID3 headers which would cause libsndfile to go into an infinite recursion + until it blew the stack. Thanks to Anders Svensson for supplying an example + file. + 2011-10-30 Erik de Castro Lopo * src/double64.c src/float32.c src/common.h diff --git a/src/id3.c b/src/id3.c index a1a189e..2fd0a0b 100644 --- a/src/id3.c +++ b/src/id3.c @@ -40,11 +40,16 @@ id3_skip (SF_PRIVATE * psf) offset = (offset << 7) | (buf [8] & 0x7f) ; offset = (offset << 7) | (buf [9] & 0x7f) ; - psf_binheader_readf (psf, "j", make_size_t (offset)) ; - psf_log_printf (psf, "ID3 length : %d\n--------------------\n", offset) ; - psf->fileoffset = 10 + offset ; + /* Never want to jump backwards in a file. */ + if (offset < 0) + return 0 ; + + /* Calculate new file offset and position ourselves there. */ + psf->fileoffset += offset + 10 ; + psf_binheader_readf (psf, "p", psf->fileoffset) ; + return 1 ; } ; -- 1.7.4.1