[vlc-commits] demux: mp4: check failed iloc release

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Sep 18 13:12:10 2020 +0200| [5c72170b39136d1effe51556c42b3d849ab51f42] | committer: Hugo Beauzée-Luyssen

demux: mp4: check failed iloc release

Reported by: Zhen Zhou, NSFOCUS Security Team
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=5c72170b39136d1effe51556c42b3d849ab51f42
---

 modules/demux/mp4/libmp4.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 7e2971d9fb..16a9d8ac20 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -4400,9 +4400,12 @@ static int MP4_ReadBox_iref( stream_t *p_stream, MP4_Box_t *p_box )
 static void MP4_FreeBox_iloc( MP4_Box_t *p_box )
 {
     MP4_Box_data_iloc_t *p_data = p_box->data.p_iloc;
-    for( uint32_t i=0; i<p_data->i_item_count; i++ )
-        free( p_data->p_items[i].p_extents );
-    free( p_data->p_items );
+    if( p_data->p_items )
+    {
+        for( uint32_t i=0; i<p_data->i_item_count; i++ )
+            free( p_data->p_items[i].p_extents );
+        free( p_data->p_items );
+    }
 }
 
 static int MP4_ReadBox_iloc( stream_t *p_stream, MP4_Box_t *p_box )