[vlc-commits] demux: mp4: fix invalid pnot deref

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  6 11:57:46 2019 +0100| [95f323c44aad92eb35671bf928e21a6f09049f1b] | committer: Francois Cartegnie

demux: mp4: fix invalid pnot deref

regression from previous rework

refs https://samples.mplayerhq.hu/mov/pnot-PICT/

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=95f323c44aad92eb35671bf928e21a6f09049f1b
---

 modules/demux/mp4/attachments.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/modules/demux/mp4/attachments.c b/modules/demux/mp4/attachments.c
index 1c93a3aee8..b1b6d8da4f 100644
--- a/modules/demux/mp4/attachments.c
+++ b/modules/demux/mp4/attachments.c
@@ -279,16 +279,25 @@ int MP4_GetAttachments( const MP4_Box_t *p_root, input_attachment_t ***ppp_attac
             char *psz_location;
             if ( asprintf( &psz_location, "pnot[%u]", i_index - 1 ) > -1 )
             {
-                input_attachment_t *p_attach =
-                        vlc_input_attachment_New(
-                            psz_location,
-                            "image/x-pict",
-                            "Quickdraw image",
-                            p_pnot->data.p_binary->p_blob,
-                            p_pnot->data.p_binary->i_blob );
-                free( psz_location );
-                if( p_attach )
-                    pp_attach[i_count++] = p_attach;
+                char rgz_path[14];
+                snprintf( rgz_path, 14,
+                         "/%4.4s[%"PRIu16"]",
+                         (const char *) &p_pnot->data.p_pnot->i_type,
+                         p_pnot->data.p_pnot->i_index - 1 );
+                const MP4_Box_t *p_pict = MP4_BoxGet( p_root, rgz_path );
+                if( p_pict )
+                {
+                    input_attachment_t *p_attach =
+                            vlc_input_attachment_New(
+                                psz_location,
+                                "image/x-pict",
+                                "Quickdraw image",
+                                p_pict->data.p_binary->p_blob,
+                                p_pict->data.p_binary->i_blob );
+                    free( psz_location );
+                    if( p_attach )
+                        pp_attach[i_count++] = p_attach;
+                }
             }
         }
     }