[vlc-commits] demux: mp4: fix overflow in cprt language decoding

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Sat Sep 27 18:26:18 2014 +0200| [fa6b1937bcbdd00726502c1f47a6826a08b5dade] | committer: Francois Cartegnie

demux: mp4: fix overflow in cprt language decoding

refs #12283

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=fa6b1937bcbdd00726502c1f47a6826a08b5dade
---

 modules/demux/mp4/libmp4.c |   19 +++++++------------
 modules/demux/mp4/libmp4.h |    4 ++--
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 1961efa..1263723 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2426,26 +2426,21 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_cprt( stream_t *p_stream, MP4_Box_t *p_box )
 {
-    unsigned int i_language;
+    uint16_t i_language;
+    bool b_mac;
 
     MP4_READBOX_ENTER( MP4_Box_data_cprt_t );
 
     MP4_GETVERSIONFLAGS( p_box->data.p_cprt );
 
-    i_language = GetWBE( p_peek );
-    for( unsigned i = 0; i < 3; i++ )
-    {
-        p_box->data.p_cprt->i_language[i] =
-            ( ( i_language >> ( (2-i)*5 ) )&0x1f ) + 0x60;
-    }
-    p_peek += 2; i_read -= 2;
+    MP4_GET2BYTES( i_language );
+    decodeQtLanguageCode( i_language, p_box->data.p_cprt->rgs_language, &b_mac );
+
     MP4_GETSTRINGZ( p_box->data.p_cprt->psz_notice );
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"cprt\" language %c%c%c notice %s",
-                      p_box->data.p_cprt->i_language[0],
-                      p_box->data.p_cprt->i_language[1],
-                      p_box->data.p_cprt->i_language[2],
+    msg_Dbg( p_stream, "read box: \"cprt\" language %3.3s notice %s",
+                      p_box->data.p_cprt->rgs_language,
                       p_box->data.p_cprt->psz_notice );
 
 #endif
diff --git a/modules/demux/mp4/libmp4.h b/modules/demux/mp4/libmp4.h
index 8668052..683b677 100644
--- a/modules/demux/mp4/libmp4.h
+++ b/modules/demux/mp4/libmp4.h
@@ -756,8 +756,8 @@ typedef struct MP4_Box_data_cprt_s
 {
     uint8_t  i_version;
     uint32_t i_flags;
-    /* 1 pad bit */
-    unsigned char i_language[3];
+
+    char     rgs_language[3]; /* ISO-639-2/T */
 
     char *psz_notice;
 } MP4_Box_data_cprt_t;