search

larsbs / id3v2lib

id3v2lib is a library written in C to read and edit id3 tags from mp3 files.
BSD 2-Clause "Simplified" License
130 stars 44 forks source link

parse_frame exceeds memory allocated by load_tag #3

Closed rbong closed 10 years ago

rbong commented 10 years ago

I have encountered many cases where parse_frame tries to copy more data from the raw tag data than the size of the memory that has been allocated for it. I assume the problem is with the size of the memory to be read set by btoi, but a simple check that the frame's target size in parse_frame doesn't exceed the size mallocated in load_tag solves the problem for now. I believe my poorly tagged songs are part of the issue, but segmentation faults are undesirable. If you need output, I would be happy to provide it.

Kontinuation commented 10 years ago

I experienced the same problem on Windows when analyzing an "PIC" tag, maybe I would try to fix that later.

Kontinuation commented 10 years ago

Seems that ID3v2.2.0 tags cannot be processed by this library, parsing ID3v2.2.0 frame headers with routines dedicated to ID3v2.3.0 results in incorrect frame size, which leads to a crash.

Maybe we need to check ID3v2 version info when loading tags, and return NULL when ID3v2.2.0 tags were encountered.