[vlc-commits] mp4: Fix crash on empty ELST

[Hugo Beauzée-Luyssen]

vlc/vlc-3.0 | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Fri Dec  8 14:21:43 2017 +0100| [677da9d5bf5e5d6bda372a1701558c4518472441] | committer: Hugo Beauzée-Luyssen

mp4: Fix crash on empty ELST

(cherry picked from commit e198d07cf316d4589e64822ab1477c7e31457b3e)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=677da9d5bf5e5d6bda372a1701558c4518472441
---

 modules/demux/mp4/libmp4.c | 3 +++
 modules/demux/mp4/mp4.c    | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 5122548040..85fb8d5a44 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -3214,6 +3214,9 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_elst );
     MP4_GET4BYTES( count );
 
+    if( count == 0 )
+        MP4_READBOX_EXIT( 1 );
+
     uint32_t i_entries_max = i_read / ((p_box->data.p_elst->i_version == 1) ? 20 : 12);
     if( count > i_entries_max )
         count = i_entries_max;
diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 173c70d400..54055b8427 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -319,7 +319,7 @@ static inline int64_t MP4_TrackGetDTS( demux_t *p_demux, mp4_track_t *p_track )
     }
 
     /* now handle elst */
-    if( p_track->p_elst )
+    if( p_track->p_elst && p_track->BOXDATA(p_elst)->i_entry_count )
     {
         MP4_Box_data_elst_t *elst = p_track->BOXDATA(p_elst);