Check that the APE tag length is valid before allocating a buffer for it.

git-svn-id: https://svn.musicpd.org/mpd/trunk@5098 09075e82-0dd4-0310-85a5-a0d7c8717e4f

1 files changed, 2 insertions, 0 deletions

diff --git a/src/tag.c b/src/tag.c
index 276aeebec..8137347a8 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -421,6 +421,8 @@ MpdTag *apeDup(char *file)
 
 	/* read tag into buffer */
 	tagLen -= sizeof(footer);
+	if (tagLen <= 0)
+		goto fail;
 	buffer = xmalloc(tagLen);
 	if (fread(buffer, 1, tagLen, fp) != tagLen)
 		goto fail;