Re: Initite loop bug in libid3tag-0.15.0b

------=_Part_17683_26687951.1201661376039
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

I am new to the usage of this mad library. I have a question regarding this.
Is the fast forward playback of mp3 is supported with this library?

Thanks and Regards,
Rahul Banerjee


On 1/13/08, Kentaro Oda <[email protected]> wrote:
>
> Hi, for the maintainer libid3tag.
>
> I found an infinite loop bug in libid3tag-0.15.0b library, which
> causes memory overflow.
>
> The problem occurs when parsing an ID3_FIELD_TYPE_STRINGLIST field,
> specifically when data to be parsed is ended with '\0'.
> In this case, **ptr == 0, but the condition end - *ptr is 1 so loop
> continues infinitely.
>
>
> *** field.c     2003-04-19 09:14:33.000000000 +0900
> --- field-patched.c     2008-01-13 16:08:22.000000000 +0900
> ***************
> *** 291,297 ****
>
>        end = *ptr + length;
>
> !       while (end - *ptr > 0) {
>        ucs4 = id3_parse_string(ptr, end - *ptr, *encoding, 0);
>        if (ucs4 == 0)
>          goto fail;
> --- 291,297 ----
>
>        end = *ptr + length;
>
> !       while (end - *ptr > 0 && **ptr != '\0') {
>        ucs4 = id3_parse_string(ptr, end - *ptr, *encoding, 0);
>        if (ucs4 == 0)
>          goto fail;
>
>
> --
> Kentaro Oda
>

------=_Part_17683_26687951.1201661376039
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<div>Hi,</div>
<div>&nbsp;</div>
<div>I am new to the usage of this mad library. I have a question regarding this. Is the fast forward playback of mp3 is supported with this library?</div>
<div>&nbsp;</div>
<div>Thanks and Regards,</div>
<div>Rahul Banerjee<br><br>&nbsp;</div>
<div><span class="gmail_quote">On 1/13/08, <b class="gmail_sendername">Kentaro Oda</b> &lt;<a href="mailto:[email protected]">[email protected]</a>&gt; wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Hi, for the maintainer libid3tag.<br><br>I found an infinite loop bug in libid3tag-0.15.0b library, which<br>
causes memory overflow.<br><br>The problem occurs when parsing an ID3_FIELD_TYPE_STRINGLIST field,<br>specifically when data to be parsed is ended with &#39;\0&#39;.<br>In this case, **ptr == 0, but the condition end - *ptr is 1 so loop<br>
continues infinitely.<br><br><br>*** field.c&nbsp;&nbsp;&nbsp;&nbsp; 2003-04-19 09:14:33.000000000 +0900<br>--- field-patched.c&nbsp;&nbsp;&nbsp;&nbsp; 2008-01-13 16:08:22.000000000 +0900<br>***************<br>*** 291,297 ****<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end = *ptr + length;<br>
<br>!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; while (end - *ptr &gt; 0) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ucs4 = id3_parse_string(ptr, end - *ptr, *encoding, 0);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (ucs4 == 0)<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; goto fail;<br>--- 291,297 ----<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end = *ptr + length;<br><br>!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; while (end - *ptr &gt; 0 &amp;&amp; **ptr != &#39;\0&#39;) {<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ucs4 = id3_parse_string(ptr, end - *ptr, *encoding, 0);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (ucs4 == 0)<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; goto fail;<br><br><br>--<br>Kentaro Oda<br></blockquote></div><br>

------=_Part_17683_26687951.1201661376039--