[vlc-commits] MP4: fix variable size leading to Out-of-bound access

[Jean-Baptiste Kempf]

vlc/vlc-2.1 | branch: master | Jean-Baptiste Kempf <jb at videolan.org> | Fri Aug  9 11:02:18 2013 +0200| [7a3dfa59497bdbe8a79bc0457048b70220e0a305] | committer: Jean-Baptiste Kempf

MP4: fix variable size leading to Out-of-bound access

Fix cid #1048765

(cherry picked from commit 03b937360b30277f1292b6e35e127d69234c2688)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.1.git/?a=commit;h=7a3dfa59497bdbe8a79bc0457048b70220e0a305
---

 modules/demux/mp4/mp4.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 43ab201..b40f1c6 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -3241,7 +3241,7 @@ static int MP4_frg_TrackCreate( demux_t *p_demux, mp4_track_t *p_track, MP4_Box_
 /**
  * Return the track identified by tid
  */
-static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint16_t tid )
+static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint32_t tid )
 {
     demux_sys_t *p_sys = p_demux->p_sys;
 
@@ -3254,7 +3254,7 @@ static mp4_track_t *MP4_frg_GetTrack( demux_t *p_demux, const uint16_t tid )
         if( ret->i_track_ID == tid )
             return ret;
     }
-    msg_Err( p_demux, "MP4_frg_GetTrack: track %"PRIu16" not found!", tid );
+    msg_Err( p_demux, "MP4_frg_GetTrack: track %"PRIu32" not found!", tid );
     return NULL;
 }
 
@@ -3552,7 +3552,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id )
         if( !p_chunk->p_first )
             goto MP4_frg_GetChunks_Error;
         uint32_t i_type = p_chunk->p_first->i_type;
-        uint16_t tid = 0;
+        uint32_t tid = 0;
         if( i_type == ATOM_uuid || i_type == ATOM_ftyp )
         {
             MP4_BoxFree( p_demux->s, p_sys->p_root );
@@ -3588,7 +3588,7 @@ static int MP4_frg_GetChunks( demux_t *p_demux, const unsigned i_tk_id )
             return MP4_frg_GetChunks( p_demux, i_tk_id );
         }
 
-        if( MP4_frg_GetChunk( p_demux, p_chunk, (unsigned *)&tid ) != VLC_SUCCESS )
+        if( MP4_frg_GetChunk( p_demux, p_chunk, &tid ) != VLC_SUCCESS )
             goto MP4_frg_GetChunks_Error;
 
         MP4_BoxFree( p_demux->s, p_chunk );