[vlc-commits] demux: libmp4: fix reading data atom

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Oct 15 16:19:48 2014 +0200| [4f3c3d74d912668990ec1321896561d55e4c3cbe] | committer: Francois Cartegnie

demux: libmp4: fix reading data atom

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=4f3c3d74d912668990ec1321896561d55e4c3cbe
---

 modules/demux/mp4/libmp4.c |   28 +++++++++++++++++++++++-----
 modules/demux/mp4/libmp4.h |   22 ++++++++++++++++++++++
 2 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 0c5b4f1..c21e1f6 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2878,17 +2878,35 @@ static void MP4_FreeBox_String( MP4_Box_t *p_box )
 static int MP4_ReadBox_data( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_data_t );
+    MP4_Box_data_data_t *p_data = p_box->data.p_data;
 
-    /* What's that header ?? */
-    if ( i_read <= 8 )
+    if ( i_read < 8 || i_read - 8 > UINT32_MAX )
         MP4_READBOX_EXIT( 0 );
 
-    p_box->data.p_data->p_blob = malloc( i_read - 8 );
+    uint8_t i_type;
+    MP4_GET1BYTE( i_type );
+    if ( i_type != 0 )
+    {
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream, "skipping unknown 'data' atom with type %"PRIu8, i_type );
+#endif
+        MP4_READBOX_EXIT( 0 );
+    }
+
+    MP4_GET3BYTES( p_data->e_wellknowntype );
+    MP4_GET2BYTES( p_data->locale.i_country );
+    MP4_GET2BYTES( p_data->locale.i_language );
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream, "read 'data' atom: knowntype=%"PRIu32", country=%"PRIu16" lang=%"PRIu16
+                 ", size %"PRId64" bytes", p_data->e_wellknowntype,
+                 p_data->locale.i_country, p_data->locale.i_language, i_read );
+#endif
+    p_box->data.p_data->p_blob = malloc( i_read );
     if ( !p_box->data.p_data->p_blob )
         MP4_READBOX_EXIT( 0 );
 
-    p_box->data.p_data->i_blob = i_read - 8;
-    memcpy( p_box->data.p_data->p_blob, p_peek + 8, i_read - 8 );
+    p_box->data.p_data->i_blob = i_read;
+    memcpy( p_box->data.p_data->p_blob, p_peek, i_read);
 
     MP4_READBOX_EXIT( 1 );
 }
diff --git a/modules/demux/mp4/libmp4.h b/modules/demux/mp4/libmp4.h
index 8824784..e8c1094 100644
--- a/modules/demux/mp4/libmp4.h
+++ b/modules/demux/mp4/libmp4.h
@@ -1312,6 +1312,28 @@ typedef struct
 
 typedef struct
 {
+    enum
+    {
+        DATA_WKT_RESERVED = 0,
+        DATA_WKT_UTF8 = 1,
+        DATA_WKT_UTF16 = 2,
+        DATA_WKT_SJIS = 3,
+        DATA_WKT_UTF8_SORT = 4,
+        DATA_WKT_UTF16_SORT = 5,
+        DATA_WKT_JPEG = 13,
+        DATA_WKT_PNG = 14,
+        DATA_WKT_BE_SIGNED = 21,
+        DATA_WKT_BE_UNSIGNED = 22,
+        DATA_WKT_BE_FLOAT32 = 23,
+        DATA_WKT_BE_FLOAT64 = 24,
+        DATA_WKT_BMP = 27,
+        DATA_WKT_QUICKTIME_METADATA_ATOM = 28,
+    } e_wellknowntype;
+    struct
+    {
+        uint16_t i_country;
+        uint16_t i_language;
+    } locale;
     uint8_t *p_blob;
     uint32_t i_blob;
 } MP4_Box_data_data_t;
diff --git a/modules/demux/mp4/meta.c b/modules/demux/mp4/meta.c
new file mode 100644
index 0000000..e69de29