From 912b24f0788114314704966a443ad8666fc99637 Mon Sep 17 00:00:00 2001
From: Michael Giacomelli <giac2000@hotmail.com>
Date: Sun, 1 Mar 2009 21:36:13 +0000
Subject: Make tremor check for very long ogg tags and truncate them if they're
 larger then 10000 characters rather then seg faulting.  Fixes FS#9866.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@20156 a1c6a512-1295-4272-9138-f99709370657
---
 apps/codecs/libtremor/info.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

(limited to 'apps/codecs')

diff --git a/apps/codecs/libtremor/info.c b/apps/codecs/libtremor/info.c
index c0bd0ae990..e96dd88b70 100644
--- a/apps/codecs/libtremor/info.c
+++ b/apps/codecs/libtremor/info.c
@@ -149,12 +149,21 @@ static int _vorbis_unpack_comment(vorbis_comment *vc,oggpack_buffer *opb){
   vc->comment_lengths=(int *)_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
 	    
   for(i=0;i<vc->comments;i++){
-    int len=oggpack_read(opb,32);
-    if(len<0)goto err_out;
-	vc->comment_lengths[i]=len;
-    vc->user_comments[i]=(char *)_ogg_calloc(len+1,1);
-    _v_readstring(opb,vc->user_comments[i],len);
-  }	  
+     int len=oggpack_read(opb,32);
+     if(len<0)goto err_out;
+     vc->comment_lengths[i]=len;
+     if(len>10000){  /*truncate long comments rather then seg faulting*/
+         vc->user_comments[i]=(char *)_ogg_calloc(10001,1);
+         _v_readstring(opb,vc->user_comments[i],10000);
+         /*just to be neat, consumed and discard the rest of the comment*/
+         len-=10000;
+         while(len--)
+             oggpack_read(opb,8);
+     }else{
+         vc->user_comments[i]=(char *)_ogg_calloc(len+1,1);
+         _v_readstring(opb,vc->user_comments[i],len);
+     }
+   }
   if(oggpack_read(opb,1)!=1)goto err_out; /* EOP check */
 
   return(0);
-- 
cgit v1.2.3