Commit f9dc591a authored by Steinar H. Gunderson's avatar Steinar H. Gunderson Committed by François Cartegnie

Fix demuxing of non-fastseekable MP4 files over 2 GB.

An uint64_t is implicity cast to an int and then checked for >= 0; ostensibly
to see if stream_Tell() failed, but once the file passes 2 GB, wraparound
kicks in and the check fails. Somehow this worked fine for local files, but not
for non-fastseekable ones (e.g. from HTTP).

Fixes #16800. Quoting myself from the bug:

Seemingly this code was introduced in ba3a2185 (May 2015), before stream_Tell()
was made to never be able to fail and thus return unsigned (in 48786ae5, Aug
2015). It seems it deliberately wanted the variable to be signed (it even casts
it back to uint64_t on the next line), but missed that it ought to be 64 bits.
dfd028fe (Oct 2015) removed the helper function MP4_stream_Tell(), but I
suppose that since this instance called stream_Tell() directly without going
through the helper, it was missed.
Signed-off-by: François Cartegnie's avatarFrancois Cartegnie <>
parent fae5025b
......@@ -4812,8 +4812,7 @@ static int DemuxAsLeaf( demux_t *p_demux )
if ( p_sys->context.i_current_box_type != ATOM_mdat )
const int i_tell = stream_Tell( p_demux->s );
if ( i_tell >= 0 && ! BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, (uint64_t)i_tell ) )
if ( !BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, stream_Tell( p_demux->s ) ) )
{// only if !b_probed ??
MP4_Box_t *p_vroot = MP4_BoxGetNextChunk( p_demux->s );
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment