diff --git a/taglib/mpeg/id3v2/frames/attachedpictureframe.cpp b/taglib/mpeg/id3v2/frames/attachedpictureframe.cpp index 8a88253f..3ad71557 100644 --- a/taglib/mpeg/id3v2/frames/attachedpictureframe.cpp +++ b/taglib/mpeg/id3v2/frames/attachedpictureframe.cpp @@ -136,6 +136,12 @@ void AttachedPictureFrame::parseFields(const ByteVector &data) int pos = 1; d->mimeType = readStringField(data, String::Latin1, &pos); + /* Now we need at least two more bytes available */ + if (pos + 1 >= data.size()) { + debug("Truncated picture frame."); + return; + } + d->type = (TagLib::ID3v2::AttachedPictureFrame::Type)data[pos++]; d->description = readStringField(data, d->textEncoding, &pos);