While they're technically invalid, it's better to skip them and try to
read the rest of the tag.
tag[3] = 0;
tlen = avio_rb24(s->pb);
}
- if (tlen <= 0 || tlen > len - taghdrlen) {
+ if (tlen < 0 || tlen > len - taghdrlen) {
av_log(s, AV_LOG_WARNING, "Invalid size in frame %s, skipping the rest of tag.\n", tag);
break;
}
len -= taghdrlen + tlen;
next = avio_tell(s->pb) + tlen;
+ if (!tlen) {
+ if (tag[0])
+ av_log(s, AV_LOG_DEBUG, "Invalid empty frame %s, skipping.\n", tag);
+ continue;
+ }
+
if (tflags & ID3v2_FLAG_DATALEN) {
avio_rb32(s->pb);
tlen -= 4;