Skip to content

Commit

Permalink
Fix buffer overflow in ID3 decode
Browse files Browse the repository at this point in the history
When the ID3 tag had >64 bytes of data for an element, there was a
1-byte out of bounds access, causing a crash at some later point in
time.  Properly limit writes to the ID3 field buffer.

Fixes earlephilhower#104
  • Loading branch information
earlephilhower committed Jul 11, 2018
1 parent 1f481a9 commit c0ec261
Show file tree
Hide file tree
Showing 3 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion library.json
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"type": "git",
"url": "https://github.com/earlephilhower/ESP8266Audio"
},
"version": "1.1",
"version": "1.1.1",
"homepage": "https://github.com/earlephilhower/ESP8266Audio",
"frameworks": "Arduino",
"examples": [
Expand Down
2 changes: 1 addition & 1 deletion library.properties
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
name=ESP8266Audio
version=1.1
version=1.1.1
author=Earle F. Philhower, III
maintainer=Earle F. Philhower, III
sentence=Audio file and I2S sound playing routines.
Expand Down
4 changes: 2 additions & 2 deletions src/AudioFileSourceID3.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -218,12 +218,12 @@ uint32_t AudioFileSourceID3::read(void *data, uint32_t len)
if (i<sizeof(value)-1) value[i] = id3.getByte();
else (void)id3.getByte();
}
value[i] = 0; // Terminate the string...
value[i<sizeof(value)-1?i:sizeof(value)-1] = 0; // Terminate the string...
if ( (frameid[0]=='T' && frameid[1]=='A' && frameid[2]=='L' && frameid[3] == 'B' ) ||
(frameid[0]=='T' && frameid[1]=='A' && frameid[2]=='L' && rev==2) ) {
cb.md("Album", isUnicode, value);
} else if ( (frameid[0]=='T' && frameid[1]=='I' && frameid[2]=='T' && frameid[3] == '2') ||
(frameid[i]=='T' && frameid[1]=='T' && frameid[2]=='2' && rev==2) ) {
(frameid[0]=='T' && frameid[1]=='T' && frameid[2]=='2' && rev==2) ) {
cb.md("Title", isUnicode, value);
} else if ( (frameid[0]=='T' && frameid[1]=='P' && frameid[2]=='E' && frameid[3] == '1') ||
(frameid[0]=='T' && frameid[1]=='P' && frameid[2]=='1' && rev==2) ) {
Expand Down

0 comments on commit c0ec261

Please sign in to comment.