Fixed unicode buffer overflow issue (metadata parser crashed with some

mp3 files).


git-svn-id: svn://svn.rockbox.org/rockbox/trunk@10324 a1c6a512-1295-4272-9138-f99709370657

2 files changed, 6 insertions, 6 deletions

diff --git a/firmware/common/unicode.c b/firmware/common/unicode.c
index 83780393d5..1dc7eedc3e 100644
--- a/firmware/common/unicode.c
+++ b/firmware/common/unicode.c
@@ -170,11 +170,11 @@ unsigned char* iso_decode(const unsigned char *iso, unsigned char *utf8,
 
 /* Recode a UTF-16 string with little-endian byte ordering to UTF-8 */
 unsigned char* utf16LEdecode(const unsigned char *utf16, unsigned char *utf8,
-        unsigned int count)
+        int count)
 {
     unsigned long ucs;
 
-    while (count != 0) {
+    while (count > 0) {
         /* Check for a surrogate pair */
         if (utf16[1] >= 0xD8 && utf16[1] < 0xE0) {
             ucs = 0x10000 + ((utf16[0] << 10) | ((utf16[1] - 0xD8) << 18)
@@ -193,11 +193,11 @@ unsigned char* utf16LEdecode(const unsigned char *utf16, unsigned char *utf8,
 
 /* Recode a UTF-16 string with big-endian byte ordering to UTF-8 */
 unsigned char* utf16BEdecode(const unsigned char *utf16, unsigned char *utf8,
-        unsigned int count)
+        int count)
 {
     unsigned long ucs;
 
-    while (count != 0) {
+    while (count > 0) {
         if (*utf16 >= 0xD8 && *utf16 < 0xE0) { /* Check for a surrogate pair */
             ucs = 0x10000 + (((utf16[0] - 0xD8) << 18) | (utf16[1] << 10)
                     | ((utf16[2] - 0xDC) << 8) | utf16[3]);
diff --git a/firmware/include/rbunicode.h b/firmware/include/rbunicode.h
index 0e12890736..66726d10b5 100644
--- a/firmware/include/rbunicode.h
+++ b/firmware/include/rbunicode.h
@@ -19,8 +19,8 @@
 /* Encode a UCS value as UTF-8 and return a pointer after this UTF-8 char. */
 unsigned char* utf8encode(unsigned long ucs, unsigned char *utf8);
 unsigned char* iso_decode(const unsigned char *latin1, unsigned char *utf8, int cp, int count);
-unsigned char* utf16LEdecode(const unsigned char *utf16, unsigned char *utf8, unsigned int count);
-unsigned char* utf16BEdecode(const unsigned char *utf16, unsigned char *utf8, unsigned int count);
+unsigned char* utf16LEdecode(const unsigned char *utf16, unsigned char *utf8, int count);
+unsigned char* utf16BEdecode(const unsigned char *utf16, unsigned char *utf8, int count);
 unsigned char* utf16decode(const unsigned char *utf16, unsigned char *utf8, unsigned int count);
 unsigned long utf8length(const unsigned char *utf8);
 const unsigned char* utf8decode(const unsigned char *utf8, unsigned short *ucs);