From 26258915a956bd1150d4d369d476770af21c71b7 Mon Sep 17 00:00:00 2001
From: Francois Cartegnie <fcvlcdev@free.fr>
Date: Mon, 22 Sep 2014 21:17:40 +0200
Subject: [PATCH] demux: mp4: fix heap buffer overflow (fix #12266)
---
modules/demux/mp4/mp4.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 8682513b5f0e..9de642dfe485 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -1762,12 +1762,15 @@ static int TrackCreateChunksIndex( demux_t *p_demux,
i_last = BOXDATA(p_stsc)->i_first_chunk[i_index] - 1;
}
- p_demux_track->chunk[0].i_sample_first = 0;
- for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ )
+ if ( p_demux_track->i_chunk_count )
{
- p_demux_track->chunk[i_chunk].i_sample_first =
- p_demux_track->chunk[i_chunk-1].i_sample_first +
- p_demux_track->chunk[i_chunk-1].i_sample_count;
+ p_demux_track->chunk[0].i_sample_first = 0;
+ for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ )
+ {
+ p_demux_track->chunk[i_chunk].i_sample_first =
+ p_demux_track->chunk[i_chunk-1].i_sample_first +
+ p_demux_track->chunk[i_chunk-1].i_sample_count;
+ }
}
msg_Dbg( p_demux, "track[Id 0x%x] read %d chunk",
--
GitLab