This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit cb6e9efa887f68967b88144b8d26f0dd3e043081 Author: Jun Zhao <[email protected]> AuthorDate: Fri Oct 23 21:16:41 2026 +0800 Commit: Jun Zhao <[email protected]> CommitDate: Sat Oct 24 15:15:50 2026 +0000 avformat/id3v2: skip unread bytes after chapter text subframes read_ttag() stops at the first NUL terminator or on decoding errors without consuming the remainder of the declared frame payload. Subtracting tlen in read_chapter() without advancing pb over the unread bytes leaves the stream misaligned for any subsequent embedded subframe. Track the number of bytes consumed by read_ttag() and skip the remainder of tlen before reading the next subframe header. Signed-off-by: Jun Zhao <[email protected]> --- libavformat/id3v2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 59493033db..22a15ab794 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -739,6 +739,7 @@ static void read_chapter(AVFormatContext *s, AVIOContext *pb, int len, len -= 16; while (len > 10) { unsigned tlen; + int64_t start, consumed; if (avio_read(pb, tag, 4) < 4) break; @@ -757,10 +758,13 @@ static void read_chapter(AVFormatContext *s, AVIOContext *pb, int len, tag, tlen); break; } + start = avio_tell(pb); if (tag[0] == 'T') read_ttag(s, pb, tlen, &chap->meta, tag); - else - avio_skip(pb, tlen); + consumed = avio_tell(pb) - start; + if (consumed < 0 || consumed > tlen || + avio_skip(pb, tlen - consumed) < 0) + break; len -= tlen; } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
