demux: mp4: check fragments

modules/demux/mp4/fragments.c

@@ -22,6 +22,7 @@
 #endif
 
 #include "fragments.h"
+#include <limits.h>
 
 void MP4_Fragments_Index_Delete( mp4_fragments_index_t *p_index )
 {
@@ -35,10 +36,12 @@ void MP4_Fragments_Index_Delete( mp4_fragments_index_t *p_index )
 
 mp4_fragments_index_t * MP4_Fragments_Index_New( unsigned i_tracks, unsigned i_num )
 {
+    if( !i_tracks || !i_num || SIZE_MAX / i_num < i_tracks )
+        return NULL;
     mp4_fragments_index_t *p_index = malloc( sizeof(*p_index) );
     if( p_index )
     {
-        p_index->p_times = calloc( i_num * i_tracks, sizeof(*p_index->p_times) );
+        p_index->p_times = calloc( (size_t)i_num * i_tracks, sizeof(*p_index->p_times) );
         p_index->pi_pos = calloc( i_num, sizeof(*p_index->pi_pos) );
         if( !p_index->p_times || !p_index->pi_pos )
         {
@@ -65,7 +68,7 @@ stime_t MP4_Fragment_Index_GetTrackStartTime( mp4_fragments_index_t *p_index,
 
 stime_t MP4_Fragment_Index_GetTrackDuration( mp4_fragments_index_t *p_index, unsigned i )
 {
-    return p_index->p_times[(p_index->i_entries - 1) * p_index->i_tracks + i];
+    return p_index->p_times[(size_t)(p_index->i_entries - 1) * p_index->i_tracks + i];
 }
 
 bool MP4_Fragments_Index_Lookup( mp4_fragments_index_t *p_index, stime_t *pi_time,
@@ -85,14 +88,14 @@ bool MP4_Fragments_Index_Lookup( mp4_fragments_index_t *p_index, stime_t *pi_tim
         }
     }
 
-    *pi_time = p_index->p_times[(p_index->i_entries - 1) * p_index->i_tracks];
+    *pi_time = p_index->p_times[(size_t)(p_index->i_entries - 1) * p_index->i_tracks];
     *pi_pos = p_index->pi_pos[p_index->i_entries - 1];
     return true;
 }
 
 #ifdef MP4_VERBOSE
 void MP4_Fragments_Index_Dump( vlc_object_t *p_obj, const mp4_fragments_index_t *p_index,
-                               uint32_t i_movie_timescale, unsigned i_tracks )
+                               uint32_t i_movie_timescale )
 {
     for( size_t i=0; i<p_index->i_entries; i++ )
     {
@@ -102,14 +105,14 @@ void MP4_Fragments_Index_Dump( vlc_object_t *p_obj, const mp4_fragments_index_t
         if( i + 1 == p_index->i_entries )
             i_end = p_index->i_last_time;
         else
-            i_end = p_index->p_times[(i + 1) * i_tracks];
+            i_end = p_index->p_times[(i + 1) * p_index->i_tracks];
 
-        for( unsigned j=0; j<i_tracks; j++ )
+        for( unsigned j=0; j<p_index->i_tracks; j++ )
         {
             char *psz_start = NULL;
             if( 0 < asprintf( &psz_start, "%s [%u]%"PRId64"ms ",
                       (psz_starts) ? psz_starts : "", j,
-                  INT64_C( 1000 ) * p_index->p_times[i * i_tracks + j] / i_movie_timescale ) )
+                  INT64_C( 1000 ) * p_index->p_times[i * p_index->i_tracks + j] / i_movie_timescale ) )
             {
                 free( psz_starts );
                 psz_starts = psz_start;

modules/demux/mp4/fragments.h

@@ -44,7 +44,7 @@ bool MP4_Fragments_Index_Lookup( mp4_fragments_index_t *p_index,
 
 #ifdef MP4_VERBOSE
 void MP4_Fragments_Index_Dump( vlc_object_t *p_obj, const mp4_fragments_index_t *p_index,
-                                uint32_t i_movie_timescale, unsigned i_tracks );
+                                uint32_t i_movie_timescale );
 #endif
 
 #endif

modules/demux/mp4/mp4.c

@@ -4110,7 +4110,7 @@ static int ProbeFragments( demux_t *p_demux, bool b_force, bool *pb_fragmented )
 
             free( pi_track_times );
 #ifdef MP4_VERBOSE
-            MP4_Fragments_Index_Dump( VLC_OBJECT(p_demux), p_sys->p_fragsindex, p_sys->i_timescale, p_sys->i_tracks );
+            MP4_Fragments_Index_Dump( VLC_OBJECT(p_demux), p_sys->p_fragsindex, p_sys->i_timescale );
 #endif
         }
     }