[vlc-commits] mp4: fix ELST signed overflow

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Nov 24 21:37:35 2017 +0200| [83a6100b42bc0cc55ddcf6667e6e3ad5ae4761cf] | committer: Rémi Denis-Courmont

mp4: fix ELST signed overflow

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=83a6100b42bc0cc55ddcf6667e6e3ad5ae4761cf
---

 modules/demux/mp4/libmp4.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 3d3e9e1858..dbe3598c62 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -3228,18 +3228,28 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
 
     for( uint32_t i = 0; i < p_box->data.p_elst->i_entry_count; i++ )
     {
+        uint64_t segment_duration;
+        int64_t media_time;
+
         if( p_box->data.p_elst->i_version == 1 )
         {
-            MP4_GET8BYTES( p_box->data.p_elst->i_segment_duration[i] );
-            MP4_GET8BYTES( p_box->data.p_elst->i_media_time[i] );
+            union { int64_t s; uint64_t u; } u;
+
+            MP4_GET8BYTES( segment_duration );
+            MP4_GET8BYTES( u.u );
+            media_time = u.s;
         }
         else
         {
-            MP4_GET4BYTES( p_box->data.p_elst->i_segment_duration[i] );
-            MP4_GET4BYTES( p_box->data.p_elst->i_media_time[i] );
-            p_box->data.p_elst->i_media_time[i] = (int32_t)p_box->data.p_elst->i_media_time[i];
+            union { int32_t s; uint32_t u; } u;
+
+            MP4_GET4BYTES( segment_duration );
+            MP4_GET4BYTES( u.u );
+            media_time = u.s;
         }
 
+        p_box->data.p_elst->i_segment_duration[i] = segment_duration;
+        p_box->data.p_elst->i_media_time[i] = media_time;
         MP4_GET2BYTES( p_box->data.p_elst->i_media_rate_integer[i] );
         MP4_GET2BYTES( p_box->data.p_elst->i_media_rate_fraction[i] );
     }