[gstreamer-bugs] [Bug 374036] [id3v2mux] ID3 Editing is not working correctly, crash injecting frames

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=374036

  GStreamer | gst-plugins-good | Ver: 0.10.4





------- Comment #21 from Tim-Philipp Müller  2006-11-20 18:26 UTC -------
Looks to me like the TENC frame in the ID3v2 tag is broken and taglib crashes
parsing that in this case because it doesn't check whether the data it wants to
read is actually available (in a normal tag reading situation it would just
read into the data of the following tags in most cases, so it's less likely to
cause any problems under other circumstances).

00000000  49 44 33 04 00 00 00 00  02 0e 54 45 4e 43 00 00  |ID3.......TENC..|
00000010  00 01 20 01 00 57 58 58  58 00 00 00 02 00 01 00  |.. ..WXXX.......|
00000020  00 54 43 4f 50 00 00 00  01 00 01 00 54 4f 50 45  |.TCOP.......TOPE|
00000030  00 00 00 01 00 01 00 43  4f 4d 4d 00 00 00 68 00  |.......COMM...h.|

The TENC frame is:

 54 45 4e 43   TENC frame marker
 00 00 00 01   Size of frame without the 10 bytes frame header
 20 01         Frame flags:
                - File alter preservation: discard frame if mp3 is altered
                - Data length indicator: a 4-byte data length indicator
                  has been added to this frame
 00            One fourth of the expected 4-byte data length indicator


Bytes missing are at least:

  - 3 bytes: rest of 4-byte data length indicator
  - 1 byte: string encoding
  - 1 byte: terminator for string #1


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email