[vlc-commits] demux: mp4: fix last chunk size computation (fix #12362)

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Oct  9 16:26:20 2014 +0200| [448cc958b4522654f6d7fdad5eef5f36831c77d1] | committer: Jean-Baptiste Kempf

demux: mp4: fix last chunk size computation (fix #12362)

(cherry picked from commit 8a0493add9682187192cc3dab514294ad0b9f541)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=448cc958b4522654f6d7fdad5eef5f36831c77d1
---

 modules/demux/mp4/mp4.c |   20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 27b3ed0..facfcff 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -1867,12 +1867,24 @@ static int TrackCreateSamplesIndex( demux_t *p_demux,
     {
         mp4_chunk_t *lastchunk = &p_demux_track->chunk[p_demux_track->i_chunk_count - 1];
         uint64_t i_total_size = lastchunk->i_offset;
-        for( uint32_t i=0; i<lastchunk->i_sample_count; i++)
+
+        if ( p_demux_track->i_sample_size != 0 ) /* all samples have same size */
+        {
+            i_total_size += (uint64_t)p_demux_track->i_sample_size * lastchunk->i_sample_count;
+        }
+        else
         {
-            if( p_demux_track->i_sample_size == 0 )
+            if( (uint64_t)lastchunk->i_sample_count + p_demux_track->i_chunk_count - 1 > stsz->i_sample_count )
+            {
+                msg_Err( p_demux, "invalid samples table: stsz table is too small" );
+                return VLC_EGENERIC;
+            }
+
+            for( uint32_t i=stsz->i_sample_count - lastchunk->i_sample_count;
+                 i<stsz->i_sample_count; i++)
+            {
                 i_total_size += stsz->i_entry_size[i];
-            else
-                i_total_size += p_demux_track->i_sample_size;
+            }
         }
 
         if ( i_total_size > p_sys->moovfragment.i_chunk_range_max_offset )