Unified · Split
| @@ -19,7 +19,7 @@ tagm4a(Tagctx *ctx) · 18 unmodified lines | |||
| 19 | sz = beuint(d) - 4; /* already have 8 bytes */ | 19 | sz = beuint(d) - 4; /* already have 8 bytes */ |
| 20 | 20 | ||
| 21 | for(;;){ | 21 | for(;;){ |
| 22 | if(ctx->seek(ctx, sz, 1) < 0) | 22 | if(sz < 0 || ctx->seek(ctx, sz, 1) < 0) |
| 23 | return -1; | 23 | return -1; |
| 24 | if(ctx->read(ctx, d, 4) != 4) /* size */ | 24 | if(ctx->read(ctx, d, 4) != 4) /* size */ |
| 25 | break; | 25 | break; |
| @@ -58,6 +58,8 @@ tagm4a(Tagctx *ctx) · 32 unmodified lines | |||
| 58 | return -1; | 58 | return -1; |
| 59 | sz -= 8; | 59 | sz -= 8; |
| 60 | skip = beuint(d) - 8; | 60 | skip = beuint(d) - 8; |
| 61 | if(skip < 0) | ||
| 62 | return -1; | ||
| 61 | 63 | ||
| 62 | if(memcmp(&d[4], "mp4a", 4) == 0){ /* audio */ | 64 | if(memcmp(&d[4], "mp4a", 4) == 0){ /* audio */ |
| 63 | n = 6+2 + 2+4+2 + 2+2 + 2+2 + 4; /* read a bunch at once */ | 65 | n = 6+2 + 2+4+2 + 2+2 + 2+2 + 4; /* read a bunch at once */ |