libid3tag: parsing UTF16 in STRINGLIST can result in infinite loop

--001a11c3eda224c0f704f286a617
Content-Type: text/plain; charset=UTF-8

Hello.

The loop that parses strings from STRINGLIST in field.c on line 294
depends only on length parameter and on function
id3_utf16_deserialize() to move the pointer *ptr by length or more in
case of UTF16. However, in several files with UTF16 ID3 tags on my PC
the *ptr pointer was moved by one byte less. Following calls of
id3_utf16_deserialize() didn't move pointer at all so the loop would
continue forever or until field->stringlist.strings filled whole
memory. I'm not sure if it's fault of invalid ID3 tags but the library
should certainly recover from it.

Because the last byte is always string terminator I fixed it with
horrible hack I attached. I have no idea if it's correct but it
avoided the infinite loop so far.

I'd love to privately send you test C source and test file with ID3
tags if you're interested.

I'm sorry for my dirty half-analysis. I already gave up on MPD which
was the only reason why I was debugging this problem.

--001a11c3eda224c0f704f286a617
Content-Type: text/x-patch; charset=US-ASCII; name="unicode-hotfix.patch"
Content-Disposition: attachment; filename="unicode-hotfix.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_hrqe705q0

LS0tIGZpZWxkLmMJMjAxNC0wMi0xNiAwNDoxNjowOS4xMDkyMTE5NjcgKzAxMDAKKysrIGZpZWxk
Mi5jCTIwMTQtMDItMTYgMDQ6MjU6NTguOTY5ODE0NzEwICswMTAwCkBAIC0yOTUsOCArMjk1LDYg
QEAKIAl1Y3M0ID0gaWQzX3BhcnNlX3N0cmluZyhwdHIsIGVuZCAtICpwdHIsICplbmNvZGluZywg
MCk7CiAJaWYgKHVjczQgPT0gMCkKIAkgIGdvdG8gZmFpbDsKLQlpZiAoKnVjczQgPT0gMCkKLQkg
ICAgYnJlYWs7CiAKIAlzdHJpbmdzID0gcmVhbGxvYyhmaWVsZC0+c3RyaW5nbGlzdC5zdHJpbmdz
LAogCQkJICAoZmllbGQtPnN0cmluZ2xpc3QubnN0cmluZ3MgKyAxKSAqIHNpemVvZigqc3RyaW5n
cykpOwo=
--001a11c3eda224c0f704f286a617--