From fc4868a04006d6ed755c7d4928267973e3f42596 Mon Sep 17 00:00:00 2001
From: "J. Alexander Treuman" <jat@spatialrift.net>
Date: Sun, 26 Nov 2006 03:51:46 +0000
Subject: Check that the APE tag length is valid before allocating a buffer for
 it.

git-svn-id: https://svn.musicpd.org/mpd/trunk@5098 09075e82-0dd4-0310-85a5-a0d7c8717e4f
---
 src/tag.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src')

diff --git a/src/tag.c b/src/tag.c
index 276aeebec..8137347a8 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -421,6 +421,8 @@ MpdTag *apeDup(char *file)
 
 	/* read tag into buffer */
 	tagLen -= sizeof(footer);
+	if (tagLen <= 0)
+		goto fail;
 	buffer = xmalloc(tagLen);
 	if (fread(buffer, 1, tagLen, fp) != tagLen)
 		goto fail;
-- 
cgit v1.2.3