[vlc-commits] demux: libmp4: fix regression in trun reading (fix #19170)

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Tue Nov 28 15:26:57 2017 +0100| [2db96938bf3ea7f2c9c7faf0b7175f76f14f947b] | committer: Francois Cartegnie

demux: libmp4: fix regression in trun reading (fix #19170)

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=2db96938bf3ea7f2c9c7faf0b7175f76f14f947b
---

 modules/demux/mp4/libmp4.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index abc2691eb8..e85599a42c 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -1119,7 +1119,13 @@ static int MP4_ReadBox_trun(  stream_t *p_stream, MP4_Box_t *p_box )
     if( p_trun->i_flags & MP4_TRUN_FIRST_FLAGS )
         MP4_GET4BYTES( p_trun->i_first_sample_flags );
 
-    if( UINT64_C(16) * count > i_read )
+    uint64_t i_entry_size =
+        !!(p_trun->i_flags & MP4_TRUN_SAMPLE_DURATION) +
+        !!(p_trun->i_flags & MP4_TRUN_SAMPLE_SIZE) +
+        !!(p_trun->i_flags & MP4_TRUN_SAMPLE_FLAGS) +
+        !!(p_trun->i_flags & MP4_TRUN_SAMPLE_TIME_OFFSET);
+
+    if( i_entry_size * 4 * count > i_read )
         MP4_READBOX_EXIT( 0 );
 
     p_trun->p_samples = vlc_alloc( count, sizeof(MP4_descriptor_trun_sample_t) );