3 files changed, 19 insertions, 2 deletions

diff --git a/apps/dsp.c b/apps/dsp.c
index 9cdc715109..29e103afb7 100644
--- a/apps/dsp.c
+++ b/apps/dsp.c
@@ -629,7 +629,10 @@ void dsp_set_eq_coefs(int band)
     cutoff = 0xffffffff / NATIVE_FREQUENCY * (*setting++);
     q = ((*setting++) << 16) / 10;        /* 16.16 */
     gain = ((*setting++) << 16) / 10;     /* s15.16 */
-
+    
+    if (q == 0)
+        q = 1;
+    
     /* The coef functions assume the EMAC unit is in fractional mode */
     #if defined(CPU_COLDFIRE) && !defined(SIMULATOR)
     /* set emac unit for dsp processing, and save old macsr, we're running in
diff --git a/apps/playback.c b/apps/playback.c
index eab6fd104f..9f8fc5a71b 100644
--- a/apps/playback.c
+++ b/apps/playback.c
@@ -2359,8 +2359,11 @@ static void mp3_set_elapsed(struct mp3entry* id3)
         }
     }
     else
+    {
         /* constant bitrate, use exact calculation */
-        id3->elapsed = id3->offset / (id3->bitrate / 8);
+        if (id3->bitrate != 0)
+            id3->elapsed = id3->offset / (id3->bitrate / 8);
+    }
 }
 
 /* Copied from mpeg.c. Should be moved somewhere else. */
diff --git a/firmware/mp3data.c b/firmware/mp3data.c
index 52aee11e2a..e3de76765b 100644
--- a/firmware/mp3data.c
+++ b/firmware/mp3data.c
@@ -118,6 +118,9 @@ static bool mp3headerinfo(struct mp3info *info, unsigned long header)
     int bitindex, freqindex;
 
     /* MPEG Audio Version */
+    if ((header & VERSION_MASK) >> 19 >= sizeof(version_table))
+        return false;
+    
     info->version = version_table[(header & VERSION_MASK) >> 19];
     if (info->version < 0)
         return false;
@@ -359,6 +362,14 @@ int get_mp3file_info(int fd, struct mp3info *info)
         return -2;
 
     /* OK, we have found a frame. Let's see if it has a Xing header */
+    if (info->frame_size-4 >= sizeof(frame))
+    {
+#if defined(DEBUG) || defined(SIMULATOR)
+        DEBUGF("Error: Invalid id3 header, frame_size: %d\n", info->frame_size);
+#endif
+        return -8;
+    }
+    
     if(read(fd, frame, info->frame_size-4) < 0)
         return -3;