From 3c67112290fec8460f7789e2d8d0b00a114439b1 Mon Sep 17 00:00:00 2001
From: Francois Cartegnie <fcvlcdev@free.fr>
Date: Fri, 16 Nov 2018 14:20:50 +0100
Subject: [PATCH] demux: libmp4: fix iref 2 bytes references read
---
modules/demux/mp4/libmp4.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 37953e43b092..24781f497fc1 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -4244,8 +4244,8 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box )
else
MP4_GET4BYTES( p_data->i_from_item_id );
MP4_GET2BYTES( p_data->i_reference_count );
-
- if( i_read / sizeof(*p_data->p_references) < p_data->i_reference_count )
+ if( i_read / ((p_box->p_father->data.p_iref->i_flags == 0 ) ? 2 : 4) <
+ p_data->i_reference_count )
MP4_READBOX_EXIT( 0 );
p_data->p_references = malloc( sizeof(*p_data->p_references) *
@@ -4254,7 +4254,7 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box )
MP4_READBOX_EXIT( 0 );
for( uint16_t i=0; i<p_data->i_reference_count; i++ )
{
- if( p_box->p_father->data.p_iref == 0 )
+ if( p_box->p_father->data.p_iref->i_flags == 0 )
MP4_GET2BYTES( p_data->p_references[i].i_to_item_id );
else
MP4_GET4BYTES( p_data->p_references[i].i_to_item_id );
--
GitLab