diff --git a/libavformat/apetag.c b/libavformat/apetag.c index 28a3ff7753087c15758b2e208b6339bcb1481429..0d2cb973fb11784dd8de86bfca47fa4c3769ba73 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -144,11 +144,11 @@ int64_t ff_ape_parse_tag(AVFormatContext *s) return 0; } - tag_start = file_size - tag_bytes - APE_TAG_FOOTER_BYTES; - if (tag_start < 0) { + if (tag_bytes > file_size - APE_TAG_FOOTER_BYTES) { av_log(s, AV_LOG_ERROR, "Invalid tag size %u.\n", tag_bytes); return 0; } + tag_start = file_size - tag_bytes - APE_TAG_FOOTER_BYTES; fields = avio_rl32(pb); /* number of fields */ if (fields > 65536) {