[vlc-commits] demux: mp4: fix heap overflow (fix #12283)

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Sep 26 15:56:25 2014 +0200| [115ebace05b4ecb5866f425ef9dfc186fdc94406] | committer: Jean-Baptiste Kempf

demux: mp4: fix heap overflow (fix #12283)

(cherry picked from commit fd9a60b0178286f603ef9b3057b4ff4ab28d7a22)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=115ebace05b4ecb5866f425ef9dfc186fdc94406
---

 modules/demux/mp4/libmp4.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 1d02274..f27d22b 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -881,7 +881,9 @@ static int MP4_ReadBox_mdhd( stream_t *p_stream, MP4_Box_t *p_box )
         MP4_GET4BYTES( p_box->data.p_mdhd->i_timescale );
         MP4_GET4BYTES( p_box->data.p_mdhd->i_duration );
     }
-    p_box->data.p_mdhd->i_language_code = i_language = GetWBE( p_peek );
+
+    MP4_GET2BYTES( i_language );
+    p_box->data.p_mdhd->i_language_code = i_language;
     for( unsigned i = 0; i < 3; i++ )
     {
         p_box->data.p_mdhd->i_language[i] =