Unified · Split
| @@ -19,7 +19,7 @@ tagm4a(Tagctx *ctx) · 18 unmodified lines | ||
| 19 | 19 | sz = beuint(d) - 4; /* already have 8 bytes */ |
| 20 | 20 | |
| 21 | 21 | for(;;){ |
| 22 | − if(ctx->seek(ctx, sz, 1) < 0) | |
| 22 | + if(sz < 0 || ctx->seek(ctx, sz, 1) < 0) | |
| 23 | 23 | return -1; |
| 24 | 24 | if(ctx->read(ctx, d, 4) != 4) /* size */ |
| 25 | 25 | break; |
| @@ -58,6 +58,8 @@ tagm4a(Tagctx *ctx) · 32 unmodified lines | ||
| 58 | 58 | return -1; |
| 59 | 59 | sz -= 8; |
| 60 | 60 | skip = beuint(d) - 8; |
| 61 | + if(skip < 0) | |
| 62 | + return -1; | |
| 61 | 63 | |
| 62 | 64 | if(memcmp(&d[4], "mp4a", 4) == 0){ /* audio */ |
| 63 | 65 | n = 6+2 + 2+4+2 + 2+2 + 2+2 + 4; /* read a bunch at once */ |