Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavformat / id3v2.c

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 46d579f466ba4e62fb5c692a53dfff87353cf9dc..e585f0eeb3f0cac076f5d6411916fdf4427ffced 100644 (file)
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -521,10 +521,11 @@ fail:
 static void read_chapter(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag, ID3v2ExtraMeta **extra_meta)
 {
     AVRational time_base = {1, 1000};
-    char title[1024];
     uint32_t start, end;
+    uint8_t *dst = NULL;
+    int encoding;
 
-    taglen -= avio_get_str(pb, taglen, title, sizeof(title));
+    decode_str(s, pb, 0, &dst, &taglen);
     if (taglen < 16)
         return;
 
@@ -538,14 +539,19 @@ static void read_chapter(AVFormatContext *s, AVIOContext *pb, int taglen, char *
         avio_read(pb, tag, 4);
         if (!memcmp(tag, "TIT2", 4)) {
             taglen = FFMIN(taglen, avio_rb32(pb));
-            if (taglen < 0)
+            if (taglen < 0) {
+                av_free(dst);
                 return;
-            avio_skip(pb, 3);
-            avio_get_str(pb, taglen, title, sizeof(title));
+            }
+            avio_skip(pb, 2);
+            encoding = avio_r8(pb);
+            av_freep(&dst);
+            decode_str(s, pb, encoding, &dst, &taglen);
         }
     }
 
-    avpriv_new_chapter(s, s->nb_chapters + 1, time_base, start, end, title);
+    avpriv_new_chapter(s, s->nb_chapters + 1, time_base, start, end, dst);
+    av_free(dst);
 }
 
 typedef struct ID3v2EMFunc {
@@ -720,9 +726,11 @@ static void id3v2_parse(AVFormatContext *s, int len, uint8_t version,
                 uint8_t *b;
 
                 b = buffer;
-                while (avio_tell(s->pb) < end && b - buffer < tlen) {
+                while (avio_tell(s->pb) < end && b - buffer < tlen && !s->pb->eof_reached) {
                     *b++ = avio_r8(s->pb);
-                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 && b - buffer < tlen) {
+                    if (*(b - 1) == 0xff && avio_tell(s->pb) < end - 1 &&
+                        b - buffer < tlen &&
+                        !s->pb->eof_reached ) {
                         uint8_t val = avio_r8(s->pb);
                         *b++ = val ? val : avio_r8(s->pb);
                     }