[vlc-commits] [Git][videolan/vlc][master] 6 commits: demux: mp4: use do/while for cslg read macros
Jean-Baptiste Kempf (@jbk)
gitlab at videolan.org
Sat Oct 10 09:50:35 UTC 2026
Jean-Baptiste Kempf pushed to branch master at VideoLAN / VLC
Commits:
928e7fda by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: use do/while for cslg read macros
The macros were scoped with braces but then it was not possible to add
semicolons after the calls. Though valid for C, the code was weird and
it was breaking tools that would not do the substitution like
coccinelle.
- - - - -
79f67ba5 by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: wrap MP4_GETVERSIONFLAGS in do/while
The macro expanded to two statements, which only works when used as a
full statement inside a block, and could lead to surprising behavior
depending on where it gets used.
- - - - -
d566037d by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: fix unreachable strf heap overflow
The remaining size of the box was stored into the 32 bits i_extra, which
was used to allocate the extra data, while the copy used the 64 bits
size. A strf box larger than 4GiB would allocate the truncated size and
copy the whole box into it.
Reject such boxes and copy the size that was allocated.
This is unreachable because it needs a >4GB stsd box which the code
before that refuses in every cases.
- - - - -
eeb9d6b5 by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: fix unreachabel dvc1 heap overflow
The remaining size of the box was stored into the 32 bits i_extra, which
was used to allocate the extra data, while the copy used the 64 bits
size. A dvc1 box larger than 4GiB would allocate the truncated size and
copy the whole box into it.
Reject such boxes and copy the size that was allocated.
This is unreachable because it needs a >4GB stsd box which the code
before that refuses in every cases.
- - - - -
22b711c9 by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: fix dvc1 allocation error check
On allocation failure the box kept i_vc1 set while p_vc1 stayed NULL,
and CopyExtradata later read from that NULL pointer.
i_vc1 is >0 in this part so simplify and add an allocation check there
to fail the box in case of memory allocation failure.
- - - - -
936ed5b2 by Alexandre Janniaux at 2026-10-10T11:17:16+02:00
demux: mp4: check CopyExtradata allocation before copying
The copy was guarded by the extradata size, which is always non-zero at
that point, instead of the allocation result. On allocation failure
p_extra was left NULL and memcpy dereferenced it. Check the allocation
result instead.
- - - - -
2 changed files:
- modules/demux/mp4/essetup.c
- modules/demux/mp4/libmp4.c
Changes:
=====================================
modules/demux/mp4/essetup.c
=====================================
@@ -44,7 +44,7 @@ static void CopyExtradata( const uint8_t *p_extra, size_t i_extra,
if( i_extra > 0 && !fmt->i_extra )
{
fmt->p_extra = malloc( i_extra );
- if( i_extra )
+ if( fmt->p_extra )
{
fmt->i_extra = i_extra;
memcpy( fmt->p_extra, p_extra, i_extra );
=====================================
modules/demux/mp4/libmp4.c
=====================================
@@ -129,9 +129,9 @@ static char * MP4_Time2Str( stime_t i_duration, uint32_t i_scale )
#define MP4_GET8BYTESLE( dst ) MP4_GETX_PRIVATE( dst, GetQWLE(p_peek), 8 )
#define MP4_GETFOURCC( dst ) MP4_GET4BYTESLE( dst )
-#define MP4_GETVERSIONFLAGS( p_void ) \
+#define MP4_GETVERSIONFLAGS( p_void ) do { \
MP4_GET1BYTE( p_void->i_version ); \
- MP4_GET3BYTES( p_void->i_flags )
+ MP4_GET3BYTES( p_void->i_flags ); } while (0)
#define READ_SAMPLE_DESC_COMMON_8BYTES_HEADER \
do\
@@ -1763,19 +1763,19 @@ static int MP4_ReadBox_cslg( stream_t *p_stream, MP4_Box_t *p_box )
union { int32_t s; uint32_t u; } u32;
union { int64_t s; uint64_t u; } u64;
#define DOREAD_CSLG( readbytes, temp, member ) \
- { readbytes( temp.u ); member = temp.s; }
+ do { readbytes( temp.u ); member = temp.s; } while (0)
-#define READ_CSLG( readbytes, temp ) {\
+#define READ_CSLG( readbytes, temp ) do {\
DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->ct_to_dts_shift );\
DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->i_least_delta );\
DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->i_max_delta );\
DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->i_composition_starttime );\
- DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->i_composition_endtime ); }
+ DOREAD_CSLG( readbytes, temp, p_box->data.p_cslg->i_composition_endtime ); } while (0)
if( i_version == 0 )
- READ_CSLG( MP4_GET4BYTES, u32 )
+ READ_CSLG( MP4_GET4BYTES, u32 );
else
- READ_CSLG( MP4_GET8BYTES, u64 )
+ READ_CSLG( MP4_GET8BYTES, u64 );
MP4_READBOX_EXIT( 1 );
}
@@ -2204,13 +2204,15 @@ static int MP4_ReadBox_strf( stream_t *p_stream, MP4_Box_t *p_box )
MP4_GET4BYTESLE( p_strf->bmiHeader.biClrUsed );
MP4_GET4BYTESLE( p_strf->bmiHeader.biClrImportant );
+ if( i_read > UINT32_MAX )
+ goto error;
p_strf->i_extra = i_read;
if ( p_strf->i_extra )
{
p_strf->p_extra = malloc( p_strf->i_extra );
if ( ! p_strf->p_extra )
goto error;
- memcpy( p_strf->p_extra, p_peek, i_read );
+ memcpy( p_strf->p_extra, p_peek, p_strf->i_extra );
}
MP4_READBOX_EXIT( 1 );
@@ -2568,9 +2570,13 @@ static int MP4_ReadBox_dvc1( stream_t *p_stream, MP4_Box_t *p_box )
MP4_Box_data_dvc1_t *p_dvc1 = p_box->data.p_dvc1;
MP4_GET1BYTE( p_dvc1->i_profile_level );
+ if( i_read > UINT32_MAX )
+ MP4_READBOX_EXIT( 0 );
p_dvc1->i_vc1 = i_read; /* Header + profile_level */
- if( p_dvc1->i_vc1 > 0 && (p_dvc1->p_vc1 = malloc( p_dvc1->i_vc1 )) )
- memcpy( p_dvc1->p_vc1, p_peek, i_read );
+ p_dvc1->p_vc1 = malloc( p_dvc1->i_vc1 );
+ if( p_dvc1->p_vc1 == NULL )
+ MP4_READBOX_EXIT( 0 );
+ memcpy( p_dvc1->p_vc1, p_peek, p_dvc1->i_vc1 );
#ifdef MP4_VERBOSE
uint8_t i_profile = (p_dvc1->i_profile_level & 0xf0) >> 4;
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/69054c83303c5ee007484023329c871ba2585a42...936ed5b2bb350e0f4e1ed803d3133dbadf6c301e
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/69054c83303c5ee007484023329c871ba2585a42...936ed5b2bb350e0f4e1ed803d3133dbadf6c301e
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list