From b9801e7f4cfdc88c10b500702b32c679ce6c477e Mon Sep 17 00:00:00 2001
From: Buschel <Buschel@a1c6a512-1295-4272-9138-f99709370657>
Date: Tue, 22 Feb 2011 07:52:21 +0000
Subject: [PATCH] Submit FS11960. Limit metadata item size like done for ID3
 tags since r29174.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@29377 a1c6a512-1295-4272-9138-f99709370657
---
 apps/metadata/metadata_common.c | 1 +
 apps/metadata/mp4.c             | 9 ++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/apps/metadata/metadata_common.c b/apps/metadata/metadata_common.c
index 4f001775f3..341d279b5d 100644
--- a/apps/metadata/metadata_common.c
+++ b/apps/metadata/metadata_common.c
@@ -344,6 +344,7 @@ long parse_tag(const char* name, char* value, struct mp3entry* id3,
     {
         len = strlen(value);
         len = MIN(len, buf_remaining - 1);
+        len = MIN(len, ID3V2_MAX_ITEM_SIZE); /* Limit max. item size. */
 
         if (len > 0)
         {
diff --git a/apps/metadata/mp4.c b/apps/metadata/mp4.c
index 746ccb286f..6130135bae 100644
--- a/apps/metadata/mp4.c
+++ b/apps/metadata/mp4.c
@@ -122,9 +122,12 @@ static unsigned int read_mp4_tag_string(int fd, int size_left, char** buffer,
          * of multiple entries is used, all following are dropped. */
         if (*dest == NULL)
         {
-            (*buffer)[bytes_read] = 0;
-            *dest = *buffer;
+            (*buffer)[bytes_read] = 0; /* zero-terminate for correct strlen().*/
             length = strlen(*buffer) + 1;
+            length = MIN(length, ID3V2_MAX_ITEM_SIZE); /* Limit item size. */
+
+            *dest = *buffer;
+            (*buffer)[length-1] = 0; /* zero-terminate buffer. */
             *buffer_left -= length;
             *buffer += length;
         }
@@ -518,7 +521,7 @@ static bool read_mp4_tags(int fd, struct mp3entry* id3,
                     char* any = NULL;
                     unsigned int length = read_mp4_tag_string(fd, size,
                         &buffer, &buffer_left, &any);
-                    
+
                     if (length > 0)
                     {
                         /* Re-use the read buffer as the dest buffer... */
-- 
2.11.4.GIT