From 93b6a1d12c31a601df6b548bda81e3c40f431c47 Mon Sep 17 00:00:00 2001
From: Miika Pekkarinen <miipekk@ihme.org>
Date: Sun, 2 Apr 2006 20:19:00 +0000
Subject: Prevent two division by zeros and one problem causing a crash in the
 mp3 metadata parser.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@9438 a1c6a512-1295-4272-9138-f99709370657
---
 firmware/mp3data.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'firmware')

diff --git a/firmware/mp3data.c b/firmware/mp3data.c
index 52aee11e2a..e3de76765b 100644
--- a/firmware/mp3data.c
+++ b/firmware/mp3data.c
@@ -118,6 +118,9 @@ static bool mp3headerinfo(struct mp3info *info, unsigned long header)
     int bitindex, freqindex;
 
     /* MPEG Audio Version */
+    if ((header & VERSION_MASK) >> 19 >= sizeof(version_table))
+        return false;
+    
     info->version = version_table[(header & VERSION_MASK) >> 19];
     if (info->version < 0)
         return false;
@@ -359,6 +362,14 @@ int get_mp3file_info(int fd, struct mp3info *info)
         return -2;
 
     /* OK, we have found a frame. Let's see if it has a Xing header */
+    if (info->frame_size-4 >= sizeof(frame))
+    {
+#if defined(DEBUG) || defined(SIMULATOR)
+        DEBUGF("Error: Invalid id3 header, frame_size: %d\n", info->frame_size);
+#endif
+        return -8;
+    }
+    
     if(read(fd, frame, info->frame_size-4) < 0)
         return -3;
 
-- 
cgit v1.2.3