diff options
Diffstat (limited to 'firmware/mp3data.c')
-rw-r--r-- | firmware/mp3data.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/firmware/mp3data.c b/firmware/mp3data.c index 52aee11e2a..e3de76765b 100644 --- a/firmware/mp3data.c +++ b/firmware/mp3data.c | |||
@@ -118,6 +118,9 @@ static bool mp3headerinfo(struct mp3info *info, unsigned long header) | |||
118 | int bitindex, freqindex; | 118 | int bitindex, freqindex; |
119 | 119 | ||
120 | /* MPEG Audio Version */ | 120 | /* MPEG Audio Version */ |
121 | if ((header & VERSION_MASK) >> 19 >= sizeof(version_table)) | ||
122 | return false; | ||
123 | |||
121 | info->version = version_table[(header & VERSION_MASK) >> 19]; | 124 | info->version = version_table[(header & VERSION_MASK) >> 19]; |
122 | if (info->version < 0) | 125 | if (info->version < 0) |
123 | return false; | 126 | return false; |
@@ -359,6 +362,14 @@ int get_mp3file_info(int fd, struct mp3info *info) | |||
359 | return -2; | 362 | return -2; |
360 | 363 | ||
361 | /* OK, we have found a frame. Let's see if it has a Xing header */ | 364 | /* OK, we have found a frame. Let's see if it has a Xing header */ |
365 | if (info->frame_size-4 >= sizeof(frame)) | ||
366 | { | ||
367 | #if defined(DEBUG) || defined(SIMULATOR) | ||
368 | DEBUGF("Error: Invalid id3 header, frame_size: %d\n", info->frame_size); | ||
369 | #endif | ||
370 | return -8; | ||
371 | } | ||
372 | |||
362 | if(read(fd, frame, info->frame_size-4) < 0) | 373 | if(read(fd, frame, info->frame_size-4) < 0) |
363 | return -3; | 374 | return -3; |
364 | 375 | ||