[vlc-commits] demux: mp4: absolute pos is unsigned

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Nov 10 10:59:51 2016 +0100| [0bd722bb26894cc93bec908775dd42b187eddde7] | committer: Francois Cartegnie

demux: mp4: absolute pos is unsigned

backported from ba3a2185e5b13b5587d7e8feeeb4e8b25bf1dae5

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=0bd722bb26894cc93bec908775dd42b187eddde7
---

 modules/demux/mp4/libmp4.c | 13 ++++++++-----
 modules/demux/mp4/libmp4.h |  2 +-
 modules/demux/mp4/mp4.c    |  5 +++--
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 3873879..04469ef 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -164,8 +164,8 @@ static int MP4_NextBox( stream_t *p_stream, MP4_Box_t *p_box )
          * and we skip the followong check */
         if( p_box->p_father->i_size > 0 )
         {
-            const off_t i_box_end = p_box->i_size + p_box->i_pos;
-            const off_t i_father_end = p_box->p_father->i_size + p_box->p_father->i_pos;
+            const uint64_t i_box_end = p_box->i_size + p_box->i_pos;
+            const uint64_t i_father_end = p_box->p_father->i_size + p_box->p_father->i_pos;
 
             /* check if it's within p-father */
             if( i_box_end >= i_father_end )
@@ -197,9 +197,12 @@ int MP4_ReadBoxContainerChildren( stream_t *p_stream,
 
     /* Size of root container is set to 0 when unknown, for exemple
      * with a DASH stream. In that case, we skip the following check */
-    if( p_container->i_size
-            && ( stream_Tell( p_stream ) + 8 >
-        (off_t)(p_container->i_pos + p_container->i_size) )
+    int64_t i_tell = stream_Tell( p_stream );
+    if( unlikely(i_tell < 0 || (UINT64_MAX - 8 < (uint64_t)i_tell)) )
+        return 0;
+
+    if( p_container->i_size && ( (uint64_t)i_tell + 8 >
+        p_container->i_pos + p_container->i_size )
       )
     {
         /* there is no box to load */
diff --git a/modules/demux/mp4/libmp4.h b/modules/demux/mp4/libmp4.h
index 7eb8939..3312257 100644
--- a/modules/demux/mp4/libmp4.h
+++ b/modules/demux/mp4/libmp4.h
@@ -1283,7 +1283,7 @@ typedef union MP4_Box_data_s
 /* the most basic structure */
 typedef struct MP4_Box_s
 {
-    off_t        i_pos;      /* absolute position */
+    uint64_t     i_pos;  /* absolute position */
 
     uint32_t     i_type;
     uint32_t     i_shortsize;
diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index d41b84b..5179c0a 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -4395,7 +4395,7 @@ static MP4_Box_t * LoadNextChunk( demux_t *p_demux )
     return p_chunk;
 }
 
-static bool BoxExistsInRootTree( MP4_Box_t *p_root, uint32_t i_type, off_t i_pos )
+static bool BoxExistsInRootTree( MP4_Box_t *p_root, uint32_t i_type, uint64_t i_pos )
 {
     while ( p_root )
     {
@@ -5433,7 +5433,8 @@ static int DemuxAsLeaf( demux_t *p_demux )
 
         if ( p_sys->context.i_current_box_type != ATOM_mdat )
         {
-            if ( ! BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, stream_Tell( p_demux->s ) ) )
+            const int64_t i_tell = stream_Tell( p_demux->s );
+            if ( i_tell >= 0 && ! BoxExistsInRootTree( p_sys->p_root, p_sys->context.i_current_box_type, (uint64_t) i_tell ) )
             {// only if !b_probed ??
                 MP4_Box_t *p_vroot = LoadNextChunk( p_demux );
                 switch( p_sys->context.i_current_box_type )