[vlc-commits] [Git][videolan/vlc][master] 4 commits: libmp4: check size to read is not bigger than SSIZE_MAX on Seek

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch master at VideoLAN / VLC


Commits:
dde55d78 by Steve Lhomme at 2023-02-18T13:18:43+00:00
libmp4: check size to read is not bigger than SSIZE_MAX on Seek

vlc_stream_Read can't read more than that (or rather report accurately that
it read more).

The 1<<17 check was just there to avoid skipping too much at once by reading
the stream. SSIZE_MAX will limit the amount of data skipped to the amount
usabled by the API.

Similar to 33371e518d851b82d075faaf9dce76ca2096138e

- - - - -
4ad6c8f7 by Steve Lhomme at 2023-02-18T13:18:43+00:00
libmp4: compare ssize_t explicitly

This is already done elsewhere in the code. The size to read cannot exceeed
SSIZE_MAX otherwise the return value will never match the source.

This is silencing a warning about signed/unsigned comparison.

- - - - -
1590221b by Steve Lhomme at 2023-02-18T13:18:43+00:00
mp4: return early when missing sbgp box and use do{}while()

Fixes an uninitialized warning, probably due to the for() with no initializer.

- - - - -
85d2e507 by Steve Lhomme at 2023-02-18T13:18:43+00:00
libmp4: use unsigned cast to compare with 0xA9

Otherwise MSVC is confused (C4310 warning). In the end it makes more
sense to test 0xA9 as an unsigned char anyway.

- - - - -


2 changed files:

- modules/demux/mp4/libmp4.c
- modules/demux/mp4/mp4.c


Changes:

=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -135,7 +135,7 @@ static char *mp4_getstringz( uint8_t **restrict in, uint64_t *restrict size )
  *  either 0xA9 + 24-bit ASCII text string (and 0xA9 isn't printable)
  *  either 32-bit ASCII text string
  */
-#define MP4_BOX_TYPE_ASCII() ( ((char*)&p_box->i_type)[0] != (char)0xA9 )
+#define MP4_BOX_TYPE_ASCII() ( ((unsigned char*)&p_box->i_type)[0] != 0xA9 )
 
 static inline uint32_t Get24bBE( const uint8_t *p )
 {
@@ -254,10 +254,10 @@ int MP4_Seek( stream_t *p_stream, uint64_t i_pos )
     uint64_t i_toread = i_pos - i_current_pos;
     if( i_toread == 0 )
         return VLC_SUCCESS;
-    else if( i_toread > (1<<17) )
+    if( i_toread > SSIZE_MAX ) // we can't read more than that
         return VLC_EGENERIC;
 
-    if( vlc_stream_Read( p_stream, NULL, i_toread ) != i_toread )
+    if( vlc_stream_Read( p_stream, NULL, i_toread ) != (ssize_t) i_toread )
         return VLC_EGENERIC;
     return VLC_SUCCESS;
 }
@@ -3928,7 +3928,7 @@ static int MP4_ReadBox_tref( stream_t *p_stream, MP4_Box_t *p_box )
 {
     /* skip header */
     size_t i_header = mp4_box_headersize( p_box );
-    if( vlc_stream_Read( p_stream, NULL, i_header ) != i_header )
+    if( vlc_stream_Read( p_stream, NULL, i_header ) != (ssize_t) i_header )
         return 0;
     /* read each reference atom with forced handler */
     uint64_t i_remain = p_box->i_size - 8;
@@ -4061,7 +4061,7 @@ static int MP4_ReadBox_meta( stream_t *p_stream, MP4_Box_t *p_box )
         return 0;
 
     /* skip over box header */
-    if( vlc_stream_Read( p_stream, NULL, i_headersize ) != i_headersize )
+    if( vlc_stream_Read( p_stream, NULL, i_headersize ) != (ssize_t) i_headersize )
         return 0;
 
     /* meta content starts with a 4 byte version/flags value (should be 0) */


=====================================
modules/demux/mp4/mp4.c
=====================================
@@ -367,7 +367,10 @@ static const MP4_Box_data_sbgp_entry_t *
 {
     const MP4_Box_t *p_sbgp = MP4_BoxGet( p_node, "sbgp" );
     const MP4_Box_data_sbgp_t *p_sbgp_data;
-    for( ; p_sbgp; p_sbgp = p_sbgp->p_next )
+    if( !p_sbgp )
+        return NULL;
+
+    do
     {
         p_sbgp_data = BOXDATA(p_sbgp);
         if( p_sbgp->i_type == ATOM_sbgp && p_sbgp_data &&
@@ -375,7 +378,8 @@ static const MP4_Box_data_sbgp_entry_t *
             (i_grouping_type_parameter == 0 ||
              p_sbgp_data->i_grouping_type_parameter == i_grouping_type_parameter) )
             break;
-    }
+        p_sbgp = p_sbgp->p_next;
+    } while(p_sbgp);
 
     if( !p_sbgp )
         return NULL;



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/bdb18949575efa2393a8fa660efb050d37663c17...85d2e507f7d9ebac02c6ec2fe554949d638208e9

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/bdb18949575efa2393a8fa660efb050d37663c17...85d2e507f7d9ebac02c6ec2fe554949d638208e9
You're receiving this email because of your account on code.videolan.org.


VideoLAN code repository instance