Rockbox

This is the bug/patch tracker for Rockbox. Click here for more information.

Quick links: Bugs · Patches · Rockbox frontpage

Tasklist

FS#11033 - Rockbox crash when displaying ID3 info with crazy long comment field

Attached to Project: Rockbox
Opened by Tomer Shalev (tomers) - Wednesday, 17 February 2010, 22:34 GMT+2
Last edited by Jonathan Gordon (jdgordon) - Thursday, 18 February 2010, 06:44 GMT+2
Task Type Bugs
Category ID3 / meta data
Status Closed
Assigned To No-one
Player Type All players
Severity High
Priority Normal
Reported Version Daily build (which?)
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Private No

Details

Rockbox crashes when going to the ID3 screen while playing the attached mp3 file.
This is reproducible in both target and simulator (r24725).

(gdb) r
Starting program: /home/user/rockbox/build_cowond2_s/rockboxui
...
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb75e9b70 (LWP 19429)]
0x080be46b in font_cache_insertion_point (fcache=0x82490fc, char_code=65527)
at /home/user/rockbox/firmware/font_cache.c:113
113 p = lru_data(&fcache->_lru, index[0]);
   take_a_bow.mp3.eye3d.txt (3.7 KiB)
   take_a_bow.mp3.file.txt (0.2 KiB)
This task depends upon

Closed by  Jonathan Gordon (jdgordon)
Thursday, 18 February 2010, 06:44 GMT+2
Reason for closing:  Fixed
Additional comments about closing:  see last comment
Comment by Tomer Shalev (tomers) - Wednesday, 17 February 2010, 22:47 GMT+2
I will personally send the affected mp3 file to whomever is interested (contact me)
Comment by Jonathan Gordon (jdgordon) - Thursday, 18 February 2010, 05:47 GMT+2
this is a buffer overrun for sure. the comment field is 1126 chars, and the id3 buffer is... #define ID3V2_BUF_SIZE 900 so its hardly surprising that it crashes.
I cant see how the mp3 metadata parser works, but this *isnt* a font bug.
Comment by Jonathan Gordon (jdgordon) - Thursday, 18 February 2010, 06:44 GMT+2
nope, I take that back. the mp3entry isnt breaking it. the scroll code breaks trying to show such a long line... still tracking down why its not handling it correctly.

band aided in r24743.

Loading...