[vlc-commits] demux: mp4: fix bogus attachment iterator

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Nov 25 21:43:20 2020 +0100| [59594e662c6f8933d33a39f2dac275fe739699ca] | committer: Francois Cartegnie

demux: mp4: fix bogus attachment iterator

invalid deref from -1 promotion
0e9db4f7e603e88488f414b7ef44ba8c323f4df0

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=59594e662c6f8933d33a39f2dac275fe739699ca
---

 modules/demux/mp4/mp4.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 30cff828c1..6d370fc026 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -2062,7 +2062,7 @@ static int Control( demux_t *p_demux, int i_query, va_list args )
             *ppp_attach = calloc( p_sys->i_attachments, sizeof(**ppp_attach ) );
             if( !*ppp_attach )
                 return VLC_ENOMEM;
-            for ( size_t i = 0; i < p_sys->i_attachments; ++i )
+            for ( ssize_t i = 0; i < p_sys->i_attachments; ++i )
             {
                 (*ppp_attach)[i] = vlc_input_attachment_Hold( p_sys->pp_attachments[i] );
                 msg_Dbg( p_demux, "adding attachment %s", (*ppp_attach)[i]->psz_name );
@@ -2190,7 +2190,7 @@ static void Close ( vlc_object_t * p_this )
         MP4_TrackClean( p_demux->out, &p_sys->track[i_track] );
     free( p_sys->track );
 
-    for ( size_t i = 0; i < p_sys->i_attachments; ++i )
+    for ( ssize_t i = 0; i < p_sys->i_attachments; ++i )
         vlc_input_attachment_Release( p_sys->pp_attachments[i] );
     free( p_sys->pp_attachments );