# HG changeset patch
# User yaz
# Date 1171940005 28800
# Node ID 1ea4cfb007e03971fe4dbf66107c0fa54aa47bd3
# Parent  fadf4c18a1cff9c4b519a2bf357d51ed8630d338
[svn] - if genre name is generated from number, it may exceed allocated memory block.

diff -r fadf4c18a1cf -r 1ea4cfb007e0 ChangeLog
--- a/ChangeLog	Mon Feb 19 18:08:27 2007 -0800
+++ b/ChangeLog	Mon Feb 19 18:53:25 2007 -0800
@@ -1,3 +1,15 @@
+2007-02-20 02:08:27 +0000  Yoshiki Yazawa <yaz@cc.rim.or.jp>
+  revision [1434]
+  madplug bug fix:
+  - no longer crashes on extra long TCON tag.
+  - now scan_file() calculates track length properly.
+  
+  trunk/src/madplug/decoder.c |   14 ++++++++++----
+  trunk/src/madplug/input.c   |   12 +++++++++---
+  trunk/src/madplug/plugin.c  |    2 ++
+  3 files changed, 21 insertions(+), 7 deletions(-)
+
+
 2007-02-19 12:55:14 +0000  Yoshiki Yazawa <yaz@cc.rim.or.jp>
   revision [1432]
   - calculate vbr bitrate properly.
diff -r fadf4c18a1cf -r 1ea4cfb007e0 src/madplug/input.c
--- a/src/madplug/input.c	Mon Feb 19 18:08:27 2007 -0800
+++ b/src/madplug/input.c	Mon Feb 19 18:53:25 2007 -0800
@@ -170,7 +170,12 @@
     string_len = mad_ucs4len((id3_ucs4_t *)string);
     tail = (id3_ucs4_t *)string + string_len;
 
-    ret = g_malloc0(BYTES(string_len + 1));
+    if(BYTES(string_len + 1) > 1024) {
+        ret = g_malloc0(BYTES(string_len + 1));
+    }
+    else {
+        ret = g_malloc0(1024);
+    }
 
     for(ptr = (id3_ucs4_t *)string; *ptr != 0 && ptr <= tail; ptr++) {
         if(*ptr == '(') {
@@ -264,8 +269,8 @@
 gchar *input_id3_get_string(struct id3_tag * tag, char *frame_name)
 {
     gchar *rtn0 = NULL, *rtn = NULL;
-    const id3_ucs4_t *string_const;
-    id3_ucs4_t *string;
+    const id3_ucs4_t *string_const = NULL;
+    id3_ucs4_t *string = NULL;
     struct id3_frame *frame;
     union id3_field *field;
     int encoding = -1;