pkg/53142: audio/id3lib dumps core reading MP3 tags

[Simon Burge <simonb%NetBSD.org@localhost>]

>Number:         53142
>Category:       pkg
>Synopsis:       audio/id3lib dumps core reading MP3 tags
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Mar 29 08:55:00 +0000 2018
>Originator:     Simon Burge
>Release:        
>Organization:
Not really
>Environment:
	System: NetBSD athlon.thistledown.com.au 8.0_BETA NetBSD 8.0_BETA (THOREAU) #3: Sat Mar 3 22:56:38 EST 2018 simonb%thoreau.thistledown.com.au@localhost:/NetBSD/src8/sys/arch/amd64/compile/THOREAU amd64
Architecture: x86_64
Machine: amd64
>Description:
	Tools built to read tags from an MP3 file (id3info from id3lib
	and audio/id3v2) abort with a stack check fail in Mp3Info::Parse :

	(gdb) bt
	#0  0x0000716e8eafe51a in _lwp_kill () from /usr/lib/libc.so.12
	#1  0x0000716e8eae9c56 in ?? () from /usr/lib/libc.so.12
	#2  0x0000716e8eae9c70 in __stack_chk_fail () from /usr/lib/libc.so.12
	#3  0x0000716e8fe4bc34 in Mp3Info::Parse (this=0x716e90117080, reader=...,
	    mp3size=4889120) at mp3_parse.cpp:566
	#4  0x0000716e8fe50dac in ID3_TagImpl::ParseReader (this=0x716e9011a0c0, reader=...)
	    at tag_parse.cpp:402
	#5  0x0000716e8fe503b9 in ID3_TagImpl::ParseFile (this=0x716e9011a0c0)
	    at tag_parse.cpp:214
	#6  0x0000716e8fe4d032 in ID3_TagImpl::Link (this=0x716e9011a0c0,
	    fileInfo=0x716e90118080 "/tmp/Levels.mp3", tag_types=65535) at tag_file.cpp:143
	#7  0x0000716e8fe4c601 in ID3_Tag::Link (this=0x7f7fff83afd0,
	    fileInfo=0x716e90118080 "/tmp/Levels.mp3", flags=65535) at tag.cpp:706
	#8  0x000000000040390b in main (argc=<optimized out>, argv=<optimized out>)
	    at demo_info.cpp:343

>How-To-Repeat:
	Install pkgsrc/audio/id3lib and run id3info on an mp3 file with tags.
	Tested against multiple mp3 files.
>Fix:
	This "fixes" the problem but I don't understand c++ so it's
	almost certainly not correct :)

--- src/mp3_parse.cpp.ORIG	2018-03-29 19:39:08.764701594 +1100
+++ src/mp3_parse.cpp	2018-03-29 19:40:00.732391017 +1100
@@ -228,7 +228,7 @@
   _mp3_header_internal *_tmpheader;
 
   const size_t HEADERSIZE = 4;//
-  char buf[HEADERSIZE+1]; //+1 to hold the \0 char
+  char buf[HEADERSIZE+1+128]; //+1 to hold the \0 char
   ID3_Reader::pos_type beg = reader.getCur() ;
   ID3_Reader::pos_type end = beg + HEADERSIZE ;
   reader.setCur(beg);

>Unformatted:
 	NetBSD 8.0_BETA (sources from netbsd-8 branch on 28 Feb 2018)
 	pkgsrc-2017Q4 (also tried -current for id3lib)