[vlc-commits] demux: libmp4: fix iref 2 bytes references read

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Nov 16 14:20:50 2018 +0100| [3c67112290fec8460f7789e2d8d0b00a114439b1] | committer: Francois Cartegnie

demux: libmp4: fix iref 2 bytes references read

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=3c67112290fec8460f7789e2d8d0b00a114439b1
---

 modules/demux/mp4/libmp4.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 37953e43b0..24781f497f 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -4244,8 +4244,8 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box )
     else
         MP4_GET4BYTES( p_data->i_from_item_id );
     MP4_GET2BYTES( p_data->i_reference_count );
-
-    if( i_read / sizeof(*p_data->p_references) < p_data->i_reference_count )
+    if( i_read / ((p_box->p_father->data.p_iref->i_flags == 0 ) ? 2 : 4) <
+            p_data->i_reference_count )
         MP4_READBOX_EXIT( 0 );
 
     p_data->p_references = malloc( sizeof(*p_data->p_references) *
@@ -4254,7 +4254,7 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box )
         MP4_READBOX_EXIT( 0 );
     for( uint16_t i=0; i<p_data->i_reference_count; i++ )
     {
-        if( p_box->p_father->data.p_iref == 0 )
+        if( p_box->p_father->data.p_iref->i_flags == 0 )
             MP4_GET2BYTES( p_data->p_references[i].i_to_item_id );
         else
             MP4_GET4BYTES( p_data->p_references[i].i_to_item_id );