2 files changed, 7 insertions, 3 deletions

diff --git a/apps/metadata/metadata_common.c b/apps/metadata/metadata_common.c
index 4f001775f3..341d279b5d 100644
--- a/apps/metadata/metadata_common.c
+++ b/apps/metadata/metadata_common.c
@@ -344,6 +344,7 @@ long parse_tag(const char* name, char* value, struct mp3entry* id3,
     {
         len = strlen(value);
         len = MIN(len, buf_remaining - 1);
+        len = MIN(len, ID3V2_MAX_ITEM_SIZE); /* Limit max. item size. */
 
         if (len > 0)
         {
diff --git a/apps/metadata/mp4.c b/apps/metadata/mp4.c
index 746ccb286f..6130135bae 100644
--- a/apps/metadata/mp4.c
+++ b/apps/metadata/mp4.c
@@ -122,9 +122,12 @@ static unsigned int read_mp4_tag_string(int fd, int size_left, char** buffer,
          * of multiple entries is used, all following are dropped. */
         if (*dest == NULL)
         {
-            (*buffer)[bytes_read] = 0;
-            *dest = *buffer;
+            (*buffer)[bytes_read] = 0; /* zero-terminate for correct strlen().*/
             length = strlen(*buffer) + 1;
+            length = MIN(length, ID3V2_MAX_ITEM_SIZE); /* Limit item size. */
+
+            *dest = *buffer;
+            (*buffer)[length-1] = 0; /* zero-terminate buffer. */
             *buffer_left -= length;
             *buffer += length;
         }
@@ -518,7 +521,7 @@ static bool read_mp4_tags(int fd, struct mp3entry* id3,
                     char* any = NULL;
                     unsigned int length = read_mp4_tag_string(fd, size,
                         &buffer, &buffer_left, &any);
-                    
+
                     if (length > 0)
                     {
                         /* Re-use the read buffer as the dest buffer... */