Commit 4f3c3d74 authored by François Cartegnie's avatar François Cartegnie 🤞
Browse files

demux: libmp4: fix reading data atom

parent 4b004f61
......@@ -2878,17 +2878,35 @@ static void MP4_FreeBox_String( MP4_Box_t *p_box )
static int MP4_ReadBox_data( stream_t *p_stream, MP4_Box_t *p_box )
{
MP4_READBOX_ENTER( MP4_Box_data_data_t );
MP4_Box_data_data_t *p_data = p_box->data.p_data;
/* What's that header ?? */
if ( i_read <= 8 )
if ( i_read < 8 || i_read - 8 > UINT32_MAX )
MP4_READBOX_EXIT( 0 );
p_box->data.p_data->p_blob = malloc( i_read - 8 );
uint8_t i_type;
MP4_GET1BYTE( i_type );
if ( i_type != 0 )
{
#ifdef MP4_VERBOSE
msg_Dbg( p_stream, "skipping unknown 'data' atom with type %"PRIu8, i_type );
#endif
MP4_READBOX_EXIT( 0 );
}
MP4_GET3BYTES( p_data->e_wellknowntype );
MP4_GET2BYTES( p_data->locale.i_country );
MP4_GET2BYTES( p_data->locale.i_language );
#ifdef MP4_VERBOSE
msg_Dbg( p_stream, "read 'data' atom: knowntype=%"PRIu32", country=%"PRIu16" lang=%"PRIu16
", size %"PRId64" bytes", p_data->e_wellknowntype,
p_data->locale.i_country, p_data->locale.i_language, i_read );
#endif
p_box->data.p_data->p_blob = malloc( i_read );
if ( !p_box->data.p_data->p_blob )
MP4_READBOX_EXIT( 0 );
p_box->data.p_data->i_blob = i_read - 8;
memcpy( p_box->data.p_data->p_blob, p_peek + 8, i_read - 8 );
p_box->data.p_data->i_blob = i_read;
memcpy( p_box->data.p_data->p_blob, p_peek, i_read);
MP4_READBOX_EXIT( 1 );
}
......
......@@ -1312,6 +1312,28 @@ typedef struct
typedef struct
{
enum
{
DATA_WKT_RESERVED = 0,
DATA_WKT_UTF8 = 1,
DATA_WKT_UTF16 = 2,
DATA_WKT_SJIS = 3,
DATA_WKT_UTF8_SORT = 4,
DATA_WKT_UTF16_SORT = 5,
DATA_WKT_JPEG = 13,
DATA_WKT_PNG = 14,
DATA_WKT_BE_SIGNED = 21,
DATA_WKT_BE_UNSIGNED = 22,
DATA_WKT_BE_FLOAT32 = 23,
DATA_WKT_BE_FLOAT64 = 24,
DATA_WKT_BMP = 27,
DATA_WKT_QUICKTIME_METADATA_ATOM = 28,
} e_wellknowntype;
struct
{
uint16_t i_country;
uint16_t i_language;
} locale;
uint8_t *p_blob;
uint32_t i_blob;
} MP4_Box_data_data_t;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment