[vlc-commits] mp4: fix off-by-one reading with nul-terminated string

[Rémi Denis-Courmont]

vlc/vlc-3.0 | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Sun Dec 10 22:23:01 2017 +0200| [3e790f126b54ec3a41b12a1ecf0f591c7a4f14c9] | committer: Rémi Denis-Courmont

mp4: fix off-by-one reading with nul-terminated string

(cherry picked from commit e018cc44508a62b381a5cbf256693a970cdc20b0)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=3e790f126b54ec3a41b12a1ecf0f591c7a4f14c9
---

 modules/demux/mp4/libmp4.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 85fb8d5a44..7a7ae3fd95 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -89,16 +89,14 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
     assert( *size <= SSIZE_MAX );
 
     size_t len = strnlen( (const char *)*in, *size );
-    if( len == 0 )
+    if( len == 0 || len >= *size )
         return NULL;
 
-    char *ret = malloc( len + 1 );
+    len++;
+
+    char *ret = malloc( len );
     if( likely(ret != NULL) )
-    {
         memcpy( ret, *in, len );
-        ret[len] = '\0';
-    }
-    len++;
     *in += len;
     *size -= len;
     return ret;