commit 5b3033a2b355068c11fe637e14ac742d273f076e

Author: Erik de Castro Lopo <erikd@mega-nerd.com>

Date:   Tue Nov 18 07:20:25 2014 -0800

    src/libFLAC/stream_decoder.c : Fix buffer read overflow.

    This is CVE-2014-8962.

    Reported-by: Michele Spagnuolo,

                 Google Security Team <mikispag@google.com>

diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c

index cb66fe2..88a656d 100644

--- a/src/libFLAC/stream_decoder.c

+++ b/src/libFLAC/stream_decoder.c

@@ -71,7 +71,7 @@ FLAC_API int FLAC_API_SUPPORTS_OGG_FLAC =

  *

  ***********************************************************************/

-static FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' };

+static const FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' };

 /***********************************************************************

  *

@@ -1361,6 +1361,10 @@ FLAC__bool find_metadata_(FLAC__StreamDecoder *decoder)

 			id = 0;

 			continue;

 		}

+

+		if(id >= 3)

+			return false;

+

 		if(x == ID3V2_TAG_[id]) {

 			id++;

 			i = 0;