libid3tag: Prevent infinite loop when parsing invalid utf-16

Kurt Roeckx <[email protected]> Sun, 18 Jun 2006 15:13:05 +0200

Newsgroups	gmane.comp.audio.mad.devel
Message-ID	<[email protected]>

Hi,

When there is an UTF-16 sequence with an odd number of bytes,
which is clearly broken, libid3tag will keep in an infinite loop
trying to parse the last byte.

The attached patch fixes it by saying we actually parsed the
last byte, and seems to work without problems so far.


Kurt

libid3tag_utf16.patch (text/plain, 753 B)

diff -urNad libid3tag-0.15.1b/utf16.c /tmp/dpep.tKvO7a/libid3tag-0.15.1b/utf16.c
--- libid3tag-0.15.1b/utf16.c	2006-01-13 15:26:29.000000000 +0100
+++ /tmp/dpep.tKvO7a/libid3tag-0.15.1b/utf16.c	2006-01-13 15:27:19.000000000 +0100
@@ -282,5 +282,18 @@
 
   free(utf16);
 
+  if (end == *ptr && length % 2 != 0)
+  {
+     /* We were called with a bogus length.  It should always
+      * be an even number.  We can deal with this in a few ways:
+      * - Always give an error.
+      * - Try and parse as much as we can and
+      *   - return an error if we're called again when we
+      *     already tried to parse everything we can.
+      *   - tell that we parsed it, which is what we do here.
+      */
+     (*ptr)++;
+  }
+
   return ucs4;
 }