[vlc-commits] demux: libmp4: fix reading WMA2 atom

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Oct  3 15:38:59 2014 +0200| [9de918380db42f41e13c79cbc5b5ca2801694e92] | committer: Francois Cartegnie

demux: libmp4: fix reading WMA2 atom

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=9de918380db42f41e13c79cbc5b5ca2801694e92
---

 modules/demux/mp4/libmp4.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index cd4d1d2..87a1654 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -1472,16 +1472,19 @@ static int MP4_ReadBox_WMA2( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET2BYTESLE( p_WMA2->Format.nBlockAlign );
     MP4_GET2BYTESLE( p_WMA2->Format.wBitsPerSample );
 
-    if ( i_read < 0 )
+    uint16_t i_cbSize;
+    MP4_GET2BYTESLE( i_cbSize );
+
+    if ( i_read < 0 || i_cbSize > i_read )
         goto error;
 
-    p_WMA2->i_extra = i_read;
+    p_WMA2->i_extra = i_cbSize;
     if ( p_WMA2->i_extra )
     {
-        p_WMA2->p_extra = malloc( i_read );
+        p_WMA2->p_extra = malloc( p_WMA2->i_extra );
         if ( ! p_WMA2->p_extra )
             goto error;
-        memcpy( p_WMA2->p_extra, p_peek, i_read );
+        memcpy( p_WMA2->p_extra, p_peek, p_WMA2->i_extra );
     }
 
     MP4_READBOX_EXIT( 1 );