Commit 03b93736 authored by Jean-Baptiste Kempf's avatar Jean-Baptiste Kempf
Browse files

MP4: fix variable size leading to Out-of-bound access

Fix cid #1048765
parent c4595ee6
...@@ -3241,7 +3241,7 @@ static int MP4_frg_TrackCreate( demux_t *p_demux, mp4_track_t *p_track, MP4_Box_ ...@@ -3241,7 +3241,7 @@ static int MP4_frg_TrackCreate( demux_t *p_demux, mp4_track_t *p_track, MP4_Box_
/** /**
* Return the track identified by tid * Return the track identified by tid
*/ */
static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint16_t tid ) static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint32_t tid )
{ {
demux_sys_t *p_sys = p_demux->p_sys; demux_sys_t *p_sys = p_demux->p_sys;
...@@ -3254,7 +3254,7 @@ static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint16_t tid ) ...@@ -3254,7 +3254,7 @@ static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint16_t tid )
if( ret->i_track_ID == tid ) if( ret->i_track_ID == tid )
return ret; return ret;
} }
msg_Err( p_demux, "MP4_frg_GetTrack: track %"PRIu16" not found!", tid ); msg_Err( p_demux, "MP4_frg_GetTrack: track %"PRIu32" not found!", tid );
return NULL; return NULL;
} }
...@@ -3552,7 +3552,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id ) ...@@ -3552,7 +3552,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id )
if( !p_chunk->p_first ) if( !p_chunk->p_first )
goto MP4_frg_GetChunks_Error; goto MP4_frg_GetChunks_Error;
uint32_t i_type = p_chunk->p_first->i_type; uint32_t i_type = p_chunk->p_first->i_type;
uint16_t tid = 0; uint32_t tid = 0;
if( i_type == ATOM_uuid || i_type == ATOM_ftyp ) if( i_type == ATOM_uuid || i_type == ATOM_ftyp )
{ {
MP4_BoxFree( p_demux->s, p_sys->p_root ); MP4_BoxFree( p_demux->s, p_sys->p_root );
...@@ -3588,7 +3588,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id ) ...@@ -3588,7 +3588,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id )
return MP4_frg_GetChunks( p_demux, i_tk_id ); return MP4_frg_GetChunks( p_demux, i_tk_id );
} }
if( MP4_frg_GetChunk( p_demux, p_chunk, (unsigned *)&tid ) != VLC_SUCCESS ) if( MP4_frg_GetChunk( p_demux, p_chunk, &tid ) != VLC_SUCCESS )
goto MP4_frg_GetChunks_Error; goto MP4_frg_GetChunks_Error;
MP4_BoxFree( p_demux->s, p_chunk ); MP4_BoxFree( p_demux->s, p_chunk );
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment