Patch from Leon Merten Lohse: Correct the length of the CD-TEXT block.

include/cdio/cdtext.h

@@ -124,7 +124,7 @@ extern "C" {
   void cdtext_init (cdtext_t *cdtext);
 
   /*! Parse raw CD-Text data into cdtext structure */ 
-  bool cdtext_data_init(cdtext_t *cdtext, uint8_t *wdata);
+  bool cdtext_data_init(cdtext_t *cdtext, uint8_t *wdata, size_t length);
   
   /*! Free memory assocated with cdtext*/
   void cdtext_destroy (cdtext_t *cdtext);

lib/driver/_cdio_generic.c

@@ -265,6 +265,7 @@ get_cdtext_generic (void *p_user_data)
 {
   generic_img_private_t *p_env = p_user_data;
   uint8_t *p_cdtext_data = NULL;
+  size_t  len;
 
   if (!p_env) return NULL;
 
@@ -273,8 +274,9 @@ get_cdtext_generic (void *p_user_data)
     if (NULL != p_cdtext_data) {
       p_env->cdtext = malloc (sizeof(cdtext_t));
       cdtext_init(p_env->cdtext);
+      len = CDIO_MMC_GET_LEN16(p_cdtext_data);
 
-      if(!cdtext_data_init (p_env->cdtext, p_cdtext_data)) {
+      if(!cdtext_data_init (p_env->cdtext, &p_cdtext_data[4], len-2)) {
         p_env->b_cdtext_error = true;
         cdtext_destroy (p_env->cdtext);
         free(p_env->cdtext);

lib/driver/cdtext.c

@@ -212,17 +212,16 @@ cdtext_set (cdtext_field_t key, track_t track, const char *p_value, cdtext_t *p_
   parse all CD-TEXT data retrieved.
 */       
 bool
-cdtext_data_init(cdtext_t *p_cdtext, uint8_t *wdata) 
+cdtext_data_init(cdtext_t *p_cdtext, uint8_t *wdata, size_t i_data) 
 {
   CDText_data_t *p_data;
-  int           i = -1;
+  int           i;
   int           j;
   char          buffer[256];
   int           idx;
   int           i_track;
   bool          b_ret = false;
   int           block = 0;
-  uint16_t      i_data = CDTEXT_GET_LEN16(wdata) - 2;
   CDText_blocksize_t p_blocksize;
   
   memset( buffer, 0x00, sizeof(buffer) );
@@ -230,10 +229,13 @@ cdtext_data_init(cdtext_t *p_cdtext, uint8_t *wdata)
   
   bzero(&p_blocksize, sizeof(CDText_blocksize_t));
 
-  p_data = (CDText_data_t *) (&wdata[4]);
+  p_data = (CDText_data_t *) wdata;
+  if (0 != i_data % sizeof(CDText_data_t)) {
+    cdio_warn("CD-Text size is not multiple of pack size");
+    return false;
+  }
 
-  for( ; i_data > 0; 
+  for( i = -1; i_data > 0; i_data -= sizeof(CDText_data_t), p_data++ ) {
-       i_data -= sizeof(CDText_data_t), p_data++ ) {
     
 #ifndef _CDTEXT_DBCC
     if ( p_data->bDBC ) {

lib/driver/image/bincue.c

@@ -328,8 +328,8 @@ parse_cuefile (_img_private_t *cd, const char *psz_cue_name)
     if(NULL != (psz_field = strtok (NULL, "\"\t\n\r"))) {
       if (cd) {
         uint8_t cdt_data[MAX_CDTEXT_DATA_LENGTH+4];
+        uint8_t *ptr;
         int size;
-        int i;
         CdioDataSource_t *source;
 
         if(NULL == (source = cdio_stdio_new(psz_field))) {
@@ -338,21 +338,18 @@ parse_cuefile (_img_private_t *cd, const char *psz_cue_name)
         }
         size = cdio_stream_read(source, cdt_data, MAX_CDTEXT_DATA_LENGTH, 1);
 
-        if (size < 4) {
+        if (size < 5) {
           cdio_log (log_level, "%s line %d: file `%s' is too small to contain CD-TEXT", psz_cue_name, i_line, psz_field);
           goto err_exit;
         }
 
-        /* prepend data length if not yet present */
+        /* cut header */
-        if (cdt_data[0] >= 0x80) {
+        if (cdt_data[0] > 0x80) {
-          for(i=size-1; i >=0; i--)
+          ptr = &cdt_data[4];
-              cdt_data[i+4] = cdt_data[i];
+          size -= 4;
-
-          cdt_data[0] = (size+2) << 8;
-          cdt_data[1] = (size+2) & 0xff;
-          cdt_data[2] = 0x00;
-          cdt_data[3] = 0x00;
         }
+        else
+          ptr = cdt_data;
 
         /* init cdtext */
         if (NULL == cd->gen.cdtext) {
@@ -360,7 +357,7 @@ parse_cuefile (_img_private_t *cd, const char *psz_cue_name)
           cdtext_init (cd->gen.cdtext);
         }
 
-        if(!cdtext_data_init(cd->gen.cdtext, cdt_data))
+        if(!cdtext_data_init(cd->gen.cdtext, cdt_data, size))
           cdio_log (log_level, "%s line %d: failed to parse CD-TEXT file `%s'", psz_cue_name, i_line, psz_field);
 
         cdio_stdio_destroy (source);

lib/driver/image/nrg.c

@@ -750,7 +750,7 @@ parse_nrg (_img_private_t *p_env, const char *psz_nrg_name,
         cdio_assert (len % sizeof (CDText_data_t) == 0);
         p_env->gen.cdtext = malloc(sizeof(cdtext_t));
         cdtext_init (p_env->gen.cdtext);
-        if(!cdtext_data_init (p_env->gen.cdtext, &wdata[-4]))
+        if(!cdtext_data_init (p_env->gen.cdtext, wdata, len))
         {
           cdtext_destroy(p_env->gen.cdtext);
           free(p_env->gen.cdtext);

lib/driver/mmc/mmc.c

@@ -369,7 +369,7 @@ mmc_read_cdtext_private ( void *p_user_data,
     /* Now read the CD-Text data */
     int	i_cdtext = CDIO_MMC_GET_LEN16(wdata);
 
-    if (i_cdtext+2 > 5000)
+    if (i_cdtext+2 > MAX_CDTEXT_DATA_LENGTH)
       i_cdtext = MAX_CDTEXT_DATA_LENGTH-2;
     else
       wdata = realloc(wdata,i_cdtext+2);

test/cdtext.right

@@ -4,9 +4,9 @@ Disc mode is listed as: CD-DA
 CD-ROM Track List (1 - 3)
   #: MSF       LSN    Type   Green? Copy? Channels Premphasis?
   1: 00:02:00  000000 audio  false  no    2        no
-  2: 00:04:00  000150 audio  false  no    2        no
+  2: 00:06:00  000300 audio  false  no    2        no
-  3: 00:06:00  000300 audio  false  no    2        no
+  3: 00:10:00  000600 audio  false  no    2        no
-170: 00:05:56  000281 leadout (645 KB raw, 645 KB formatted)
+170: 00:14:06  000906 leadout (2 MB raw, 2 MB formatted)
 Media Catalog Number (MCN): not available
 Last CD Session LSN: not supported by drive/driver
 audio status: not implemented

test/check_cue.sh.in

@@ -52,8 +52,8 @@ if test -f ${srcdir}/data/${fname}.bin ; then
     opts="--quiet --no-device-info --cue-file ${srcdir}/data/${fname}.cue --no-cddb"
     cp ${srcdir}/data/${fname}.cdt ${srcdir}/${fname}.cdt
     test_cdinfo "$opts" ${fname}.dump ${srcdir}/${fname}.right
-    rm ${srcdir}/${fname}.cdt
     RC=$?
+    rm ${srcdir}/${fname}.cdt
     check_result $RC "cd-info CD-Text CUE test $testnum" "${CD_INFO} $opts"
   else
     echo "Don't see CD-Text file ${srcdir}/data/${fname}.cdt. Test $testnum skipped."