changeset 3540:3dfb35d2ac51 libavformat

All mp3 parsers are buggy fix 2 of n (out of array write, i suspect not exploitable)
author michael
date Fri, 04 Jul 2008 22:04:41 +0000
parents 4dee13c8073a
children b50bdfaf90f5
files mp3.c
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/mp3.c	Fri Jul 04 22:00:35 2008 +0000
+++ b/mp3.c	Fri Jul 04 22:04:41 2008 +0000
@@ -205,7 +205,7 @@
         break;
 
     case 3:  /* UTF-8 */
-        len = FFMIN(taglen, dstlen);
+        len = FFMIN(taglen, dstlen-1);
         get_buffer(s->pb, dst, len);
         dst[len] = 0;
         break;