changeset 675:1ea4cfb007e0 trunk

[svn] - if genre name is generated from number, it may exceed allocated memory block.
author yaz
date Mon, 19 Feb 2007 18:53:25 -0800
parents fadf4c18a1cf
children 1733b12ef974
files ChangeLog src/madplug/input.c
diffstat 2 files changed, 20 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/ChangeLog	Mon Feb 19 18:08:27 2007 -0800
+++ b/ChangeLog	Mon Feb 19 18:53:25 2007 -0800
@@ -1,3 +1,15 @@
+2007-02-20 02:08:27 +0000  Yoshiki Yazawa <yaz@cc.rim.or.jp>
+  revision [1434]
+  madplug bug fix:
+  - no longer crashes on extra long TCON tag.
+  - now scan_file() calculates track length properly.
+  
+  trunk/src/madplug/decoder.c |   14 ++++++++++----
+  trunk/src/madplug/input.c   |   12 +++++++++---
+  trunk/src/madplug/plugin.c  |    2 ++
+  3 files changed, 21 insertions(+), 7 deletions(-)
+
+
 2007-02-19 12:55:14 +0000  Yoshiki Yazawa <yaz@cc.rim.or.jp>
   revision [1432]
   - calculate vbr bitrate properly.
--- a/src/madplug/input.c	Mon Feb 19 18:08:27 2007 -0800
+++ b/src/madplug/input.c	Mon Feb 19 18:53:25 2007 -0800
@@ -170,7 +170,12 @@
     string_len = mad_ucs4len((id3_ucs4_t *)string);
     tail = (id3_ucs4_t *)string + string_len;
 
-    ret = g_malloc0(BYTES(string_len + 1));
+    if(BYTES(string_len + 1) > 1024) {
+        ret = g_malloc0(BYTES(string_len + 1));
+    }
+    else {
+        ret = g_malloc0(1024);
+    }
 
     for(ptr = (id3_ucs4_t *)string; *ptr != 0 && ptr <= tail; ptr++) {
         if(*ptr == '(') {
@@ -264,8 +269,8 @@
 gchar *input_id3_get_string(struct id3_tag * tag, char *frame_name)
 {
     gchar *rtn0 = NULL, *rtn = NULL;
-    const id3_ucs4_t *string_const;
-    id3_ucs4_t *string;
+    const id3_ucs4_t *string_const = NULL;
+    id3_ucs4_t *string = NULL;
     struct id3_frame *frame;
     union id3_field *field;
     int encoding = -1;