Bug in libid3tag - mad-dev

8 Oct 2002


      I have found that the function id3_render_paddedstring will crash if you are
rendering a string that is longer (or exactly as long as) the length
parameter you give it.
Basically, length would be decremented to zero in the first loop and by the
time it got to the second loop it wrapped around back to 0xFFFFFFFF. It is
unsigned so a <=0 comparison won't help.
I have changed two lines (marked below). Rob, if I read your code correctly
I'm guessing you have somewhat of an antipathy toward "for" loops, so adapt
as you see fit.
- Mark Malson
id3_length_t id3_render_paddedstring(id3_byte_t **ptr, id3_ucs4_t const
*ucs4, id3_length_t length)
{
  id3_ucs4_t padded[31], *data;
  int        i;
/* latin1 encoding only (this is used for ID3v1 fields) */
assert(length <= 30);
data = padded;
if (ucs4) {
/*
**  This line used to read:
**  while (*ucs4 && length--) {
*/
    for (i=0; (i<length) && *ucs4; i++) {
      *data++ = *ucs4++;
if (data[-1] == '\n')
        data[-1] = ' ';
    }
  }
/*
**  This line used to read:
**  while (length--)
*/
  for ( ; i<length; i++)
    *data++ = ' ';
*data = 0;
return id3_latin1_serialize(ptr, padded, 0);
}