actually the fix is very simple; remove the id3v2 tags from the mp3's. id3v1 tags are 128 bytes at the end of the file, so a buffer expoit would only be possible if the buffers weren't correctly coded for in the first place. The fields are an exact length. id3v2 is at the begining of the file; it is variable in length, so if you add the v2 tag (or even lengthen it by adding more info) approx 5 Megs have to be read and rewritten to disk. How sane is that?
btw: where is Zombie to tell us that integrating IE and WMP into the OS is a good thing?? Users don't even have to play the song -- all they have to do is open the "My Music" directory, or hover the mouse over a link.... wtf?
-t.