[vlc-commits] Fix demuxing of non-fastseekable MP4 files over 2 GB.

[Steinar H. Gunderson]

vlc | branch: master | Steinar H. Gunderson <sesse at google.com> | Fri Apr  8 11:46:50 2016 +0200| [f9dc591a3e5b47c3454c9a2573f2b9b1a5145ec3] | committer: Francois Cartegnie

Fix demuxing of non-fastseekable MP4 files over 2 GB.

An uint64_t is implicity cast to an int and then checked for >= 0; ostensibly
to see if stream_Tell() failed, but once the file passes 2 GB, wraparound
kicks in and the check fails. Somehow this worked fine for local files, but not
for non-fastseekable ones (e.g. from HTTP).

Fixes #16800. Quoting myself from the bug:

Seemingly this code was introduced in ba3a2185 (May 2015), before stream_Tell()
was made to never be able to fail and thus return unsigned (in 48786ae5, Aug
2015). It seems it deliberately wanted the variable to be signed (it even casts
it back to uint64_t on the next line), but missed that it ought to be 64 bits.
dfd028fe (Oct 2015) removed the helper function MP4_stream_Tell(), but I
suppose that since this instance called stream_Tell() directly without going
through the helper, it was missed.

Signed-off-by: Francois Cartegnie <fcvlcdev at free.fr>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=f9dc591a3e5b47c3454c9a2573f2b9b1a5145ec3
---

 modules/demux/mp4/mp4.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 9081d6d..2ad2913 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -4812,8 +4812,7 @@ static int DemuxAsLeaf( demux_t *p_demux )
 
         if ( p_sys->context.i_current_box_type != ATOM_mdat )
         {
-            const int i_tell = stream_Tell( p_demux->s );
-            if ( i_tell >= 0 && ! BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, (uint64_t)i_tell ) )
+            if ( !BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, stream_Tell( p_demux->s ) ) )
             {// only if !b_probed ??
                 MP4_Box_t *p_vroot = MP4_BoxGetNextChunk( p_demux->s );
                 if(!p_vroot)