diff options
-rw-r--r-- | apps/metadata/metadata_common.c | 1 | ||||
-rw-r--r-- | apps/metadata/mp4.c | 9 |
2 files changed, 7 insertions, 3 deletions
diff --git a/apps/metadata/metadata_common.c b/apps/metadata/metadata_common.c index 4f001775f3..341d279b5d 100644 --- a/apps/metadata/metadata_common.c +++ b/apps/metadata/metadata_common.c | |||
@@ -344,6 +344,7 @@ long parse_tag(const char* name, char* value, struct mp3entry* id3, | |||
344 | { | 344 | { |
345 | len = strlen(value); | 345 | len = strlen(value); |
346 | len = MIN(len, buf_remaining - 1); | 346 | len = MIN(len, buf_remaining - 1); |
347 | len = MIN(len, ID3V2_MAX_ITEM_SIZE); /* Limit max. item size. */ | ||
347 | 348 | ||
348 | if (len > 0) | 349 | if (len > 0) |
349 | { | 350 | { |
diff --git a/apps/metadata/mp4.c b/apps/metadata/mp4.c index 746ccb286f..6130135bae 100644 --- a/apps/metadata/mp4.c +++ b/apps/metadata/mp4.c | |||
@@ -122,9 +122,12 @@ static unsigned int read_mp4_tag_string(int fd, int size_left, char** buffer, | |||
122 | * of multiple entries is used, all following are dropped. */ | 122 | * of multiple entries is used, all following are dropped. */ |
123 | if (*dest == NULL) | 123 | if (*dest == NULL) |
124 | { | 124 | { |
125 | (*buffer)[bytes_read] = 0; | 125 | (*buffer)[bytes_read] = 0; /* zero-terminate for correct strlen().*/ |
126 | *dest = *buffer; | ||
127 | length = strlen(*buffer) + 1; | 126 | length = strlen(*buffer) + 1; |
127 | length = MIN(length, ID3V2_MAX_ITEM_SIZE); /* Limit item size. */ | ||
128 | |||
129 | *dest = *buffer; | ||
130 | (*buffer)[length-1] = 0; /* zero-terminate buffer. */ | ||
128 | *buffer_left -= length; | 131 | *buffer_left -= length; |
129 | *buffer += length; | 132 | *buffer += length; |
130 | } | 133 | } |
@@ -518,7 +521,7 @@ static bool read_mp4_tags(int fd, struct mp3entry* id3, | |||
518 | char* any = NULL; | 521 | char* any = NULL; |
519 | unsigned int length = read_mp4_tag_string(fd, size, | 522 | unsigned int length = read_mp4_tag_string(fd, size, |
520 | &buffer, &buffer_left, &any); | 523 | &buffer, &buffer_left, &any); |
521 | 524 | ||
522 | if (length > 0) | 525 | if (length > 0) |
523 | { | 526 | { |
524 | /* Re-use the read buffer as the dest buffer... */ | 527 | /* Re-use the read buffer as the dest buffer... */ |