[vlc-commits] demux: mp4: set pointer to relase function into box

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon Sep 29 18:31:44 2014 +0200| [0ad6f449b6741c7c2c7c7058e72310eb2138d860] | committer: Francois Cartegnie

demux: mp4: set pointer to relase function into box

Possible could crash because release function was
not correctly matched du to missing parent id check.

Better save it into box instead of doing another lookup,
and because box could have been detached from parent.

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=0ad6f449b6741c7c2c7c7058e72310eb2138d860
---

 modules/demux/mp4/libmp4.c |   15 ++++-----------
 modules/demux/mp4/libmp4.h |    6 ++++--
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index b6cf91c..075bc0b 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -3677,6 +3677,8 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
         return NULL;
     }
 
+    p_box->pf_free = MP4_Box_Function[i_index].MP4_FreeBox_function;
+
     return p_box;
 }
 
@@ -3686,7 +3688,6 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
  *****************************************************************************/
 void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
 {
-    unsigned int i_index;
     MP4_Box_t    *p_child;
 
     if( !p_box )
@@ -3704,15 +3705,7 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
     /* Now search function to call */
     if( p_box->data.p_payload )
     {
-        for( i_index = 0; ; i_index++ )
-        {
-            if( ( MP4_Box_Function[i_index].i_type == p_box->i_type )||
-                ( MP4_Box_Function[i_index].i_type == 0 ) )
-            {
-                break;
-            }
-        }
-        if( MP4_Box_Function[i_index].MP4_FreeBox_function == NULL )
+        if (unlikely( p_box->pf_free == NULL ))
         {
             /* Should not happen */
             if MP4_BOX_TYPE_ASCII()
@@ -3726,7 +3719,7 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
         }
         else
         {
-            MP4_Box_Function[i_index].MP4_FreeBox_function( p_box );
+            p_box->pf_free( p_box );
         }
         free( p_box->data.p_payload );
     }
diff --git a/modules/demux/mp4/libmp4.h b/modules/demux/mp4/libmp4.h
index 643e922..b8315cb 100644
--- a/modules/demux/mp4/libmp4.h
+++ b/modules/demux/mp4/libmp4.h
@@ -1368,8 +1368,9 @@ typedef union MP4_Box_data_s
 
 
 
+typedef struct MP4_Box_s MP4_Box_t;
 /* the most basic structure */
-typedef struct MP4_Box_s
+struct MP4_Box_s
 {
     off_t        i_pos;      /* absolute position */
 
@@ -1397,7 +1398,8 @@ typedef struct MP4_Box_s
 
     struct MP4_Box_s *p_next;   /* pointer on the next boxes at the same level */
 
-} MP4_Box_t;
+    void (*pf_free)( MP4_Box_t *p_box ); /* pointer to free function for this box */
+};
 
 static inline size_t mp4_box_headersize( MP4_Box_t *p_box )
 {