changeset 2334:0dd31200a33a

Fix problems with pointer arithmetic (Bugzilla #72)
author Jussi Judin <jjudin+audacious@iki.fi>
date Wed, 23 Jan 2008 14:11:29 +0100
parents 5b37a9f2d0cc
children 6b9d5a8b509e
files src/madplug/input.c
diffstat 1 files changed, 7 insertions(+), 6 deletions(-) [+]
line wrap: on
line diff
--- a/src/madplug/input.c	Sun Jan 20 14:53:47 2008 +0100
+++ b/src/madplug/input.c	Wed Jan 23 14:11:29 2008 +0100
@@ -169,9 +169,9 @@
         ret = g_malloc0(1024);
     }
 
-    for(ptr = (id3_ucs4_t *)string; *ptr != 0 && ptr <= tail; ptr++) {
+    for(ptr = (id3_ucs4_t *)string; ptr <= tail && *ptr != 0; ptr++) {
         if(*ptr == '(') {
-            if(*(++ptr) == '(') { // escaped text like: ((something)
+            if(ptr < tail && *(++ptr) == '(') { // escaped text like: ((something)
                 for(end = ptr; *end != ')' && *end != 0;) { // copy "(something)"
                     end++;
                 }
@@ -181,7 +181,7 @@
                 *(ret + ret_len) = 0; //terminate
                 ptr = end + 1;
             }
-            else {
+            else if (ptr <= tail && *ptr != 0) {
                 // reference to an id3v1 genre code
                 for(end = ptr; *end != ')' && *end != 0;) {
                     end++;
@@ -199,7 +199,7 @@
 
                 tmp_len = mad_ucs4len(genre);
 
-                memcpy(ret + BYTES(ret_len), genre, BYTES(tmp_len));
+                memcpy(ret + ret_len, genre, BYTES(tmp_len));
 
                 ret_len += tmp_len;
                 *(ret + ret_len) = 0; //terminate
@@ -219,6 +219,7 @@
                 }
                 tp++;
             }
+
             if(is_num) {
                 AUDDBG("is_num!\n");
 
@@ -235,7 +236,7 @@
 
                 tmp_len = mad_ucs4len(genre);
 
-                memcpy(ret + BYTES(ret_len), genre, BYTES(tmp_len));
+                memcpy(ret + ret_len, genre, BYTES(tmp_len));
 
                 ret_len += tmp_len;
                 *(ret + ret_len) = 0; //terminate
@@ -245,7 +246,7 @@
                 AUDDBG("ret_len = %d\n", ret_len);
                 AUDDBG("end - ptr = %d\n", BYTES(end - ptr));
 
-                memcpy(ret + BYTES(ret_len), ptr, BYTES(end - ptr));
+                memcpy(ret + ret_len, ptr, BYTES(end - ptr));
                 ret_len = ret_len + (end - ptr);
                 *(ret + ret_len) = 0; //terminate
                 ptr += (end - ptr);