[vlc-commits] mp4: Fix crash on empty ELST

[Hugo Beauzée-Luyssen]

vlc | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Fri Dec  8 14:21:43 2017 +0100| [e198d07cf316d4589e64822ab1477c7e31457b3e] | committer: Hugo Beauzée-Luyssen

mp4: Fix crash on empty ELST

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=e198d07cf316d4589e64822ab1477c7e31457b3e
---

 modules/demux/mp4/libmp4.c | 3 +++
 modules/demux/mp4/mp4.c    | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 60767f9eb0..c935f88a28 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -3246,6 +3246,9 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_elst );
     MP4_GET4BYTES( count );
 
+    if( count == 0 )
+        MP4_READBOX_EXIT( 1 );
+
     uint32_t i_entries_max = i_read / ((p_box->data.p_elst->i_version == 1) ? 20 : 12);
     if( count > i_entries_max )
         count = i_entries_max;
diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 442694d413..549644b79d 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -321,7 +321,7 @@ static inline int64_t MP4_TrackGetDTS( demux_t *p_demux, mp4_track_t *p_track )
     }
 
     /* now handle elst */
-    if( p_track->p_elst )
+    if( p_track->p_elst && p_track->BOXDATA(p_elst)->i_entry_count )
     {
         MP4_Box_data_elst_t *elst = p_track->BOXDATA(p_elst);