[vlc-commits] demux: libmp4: fix heap buffer write ofw in chpl (fix #12366)

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Oct  9 14:44:36 2014 +0200| [8d8617bb938036a444e02425bffa6cad9bcbd855] | committer: Jean-Baptiste Kempf

demux: libmp4: fix heap buffer write ofw in chpl (fix #12366)

(cherry picked from commit d1bdd44b1902f62453f6982e1ee09a5b243f25ee)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=8d8617bb938036a444e02425bffa6cad9bcbd855
---

 modules/demux/mp4/libmp4.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index d776254..6078321 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2823,6 +2823,8 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
         uint64_t i_start;
         uint8_t i_len;
         int i_copy;
+        if ( i_read < 9 )
+            break;
         MP4_GET8BYTES( i_start );
         MP4_GET1BYTE( i_len );
 
@@ -2839,6 +2841,10 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
         p_peek += i_copy;
         i_read -= i_copy;
     }
+
+    if ( i != p_chpl->i_chapter )
+        p_chpl->i_chapter = i;
+
     /* Bubble sort by increasing start date */
     do
     {