[vlc-commits] demux: mp4: fix reading tfra

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Sat May 24 17:00:43 2014 +0200| [90f7c0b02e49c188042d692fdc8c6ee9b915dc86] | committer: Francois Cartegnie

demux: mp4: fix reading tfra

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=90f7c0b02e49c188042d692fdc8c6ee9b915dc86
---

 modules/demux/mp4/libmp4.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 4cb0292..34021ad 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -3064,15 +3064,25 @@ static int MP4_ReadBox_tfra( stream_t *p_stream, MP4_Box_t *p_box )
                         || !p_tfra->p_trun_number || !p_tfra->p_sample_number )
         goto error;
 
-    for( uint32_t i = 0; i < i_number_of_entries; i++ )
+    int i_fields_length = 3 + p_tfra->i_length_size_of_traf_num
+            + p_tfra->i_length_size_of_trun_num
+            + p_tfra->i_length_size_of_sample_num;
+
+    uint32_t i;
+    for( i = 0; i < i_number_of_entries; i++ )
     {
+
         if( p_tfra->i_version == 1 )
         {
+            if ( i_read < i_fields_length + 16 )
+                break;
             MP4_GET8BYTES( p_tfra->p_time[i*2] );
             MP4_GET8BYTES( p_tfra->p_moof_offset[i*2] );
         }
         else
         {
+            if ( i_read < i_fields_length + 8 )
+                break;
             MP4_GET4BYTES( p_tfra->p_time[i] );
             MP4_GET4BYTES( p_tfra->p_moof_offset[i] );
         }
@@ -3130,6 +3140,8 @@ static int MP4_ReadBox_tfra( stream_t *p_stream, MP4_Box_t *p_box )
                 goto error;
         }
     }
+    if ( i < i_number_of_entries )
+        i_number_of_entries = i;
 
 #ifdef MP4_VERBOSE
     if( p_tfra->i_version == 0 )