[vlc-commits] mux: libmp4: check id limits

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon Oct 21 12:08:39 2019 +0200| [68b8d40f37b4e9f9bc3868205d6abf753f723364] | committer: Francois Cartegnie

mux: libmp4: check id limits

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=68b8d40f37b4e9f9bc3868205d6abf753f723364
---

 modules/mux/mp4/libmp4mux.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/modules/mux/mp4/libmp4mux.c b/modules/mux/mp4/libmp4mux.c
index 1e26c5cab7..843c320698 100644
--- a/modules/mux/mp4/libmp4mux.c
+++ b/modules/mux/mp4/libmp4mux.c
@@ -139,6 +139,8 @@ static void mp4mux_trackinfo_Clear(mp4mux_trackinfo_t *p_stream)
 mp4mux_trackinfo_t * mp4mux_track_Add(mp4mux_handle_t *h, unsigned id,
                                       const es_format_t *fmt, uint32_t timescale)
 {
+    if(unlikely(id == 0))
+        return NULL;
     mp4mux_trackinfo_t *t = malloc(sizeof(*t));
     if(!t || !mp4mux_trackinfo_Init(t, 0, 0))
     {
@@ -1691,7 +1693,15 @@ bo_t * mp4mux_GetMoov(mp4mux_handle_t *h, vlc_object_t *p_obj, vlc_tick_t i_dura
     const mp4mux_trackinfo_t *lasttrack = vlc_array_count(&h->tracks)
                                         ? vlc_array_item_at_index(&h->tracks, vlc_array_count(&h->tracks) - 1)
                                         : NULL;
-    bo_add_32be(mvhd, lasttrack ? lasttrack->i_track_id + 1: 1); // next-track-id
+    uint32_t i_next_track_id = 1;
+    if(lasttrack)
+    {
+        if(lasttrack->i_track_id < 0xFFFFFFFFU)
+            i_next_track_id += lasttrack->i_track_id;
+        else
+            i_next_track_id = 0xFFFFFFFFU;
+    }
+    bo_add_32be(mvhd, i_next_track_id); // next-track-id
 
     box_gather(moov, mvhd);