Skip to content

V
vlc-1.1
Commit ba67168b authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont
Browse files
Options

Handle memory errors in MP4 stts - fixes #1502

parent 1e08726c
Hide whitespace changes
Inline Side-by-side
Showing with 15 additions and 8 deletions
modules/demux/mp4/libmp4.c
View file @ ba67168b
...@@ -782,10 +782,15 @@ static int MP4_ReadBox_dref( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -782,10 +782,15 @@ static int MP4_ReadBox_dref( stream_t *p_stream, MP4_Box_t *p_box )
MP4_READBOX_EXIT( 1 ); MP4_READBOX_EXIT( 1 );
} }
static void MP4_FreeBox_stts( MP4_Box_t *p_box )
{
FREENULL( p_box->data.p_stts->i_sample_count );
FREENULL( p_box->data.p_stts->i_sample_delta );
}
static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
{ {
unsigned int i; unsigned int i, code = 0;
MP4_READBOX_ENTER( MP4_Box_data_stts_t ); MP4_READBOX_ENTER( MP4_Box_data_stts_t );
MP4_GETVERSIONFLAGS( p_box->data.p_stts ); MP4_GETVERSIONFLAGS( p_box->data.p_stts );
...@@ -795,6 +800,12 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -795,6 +800,12 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) ); calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
p_box->data.p_stts->i_sample_delta = p_box->data.p_stts->i_sample_delta =
calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) ); calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
if( p_box->data.p_stts->i_sample_count == NULL
|| p_box->data.p_stts->i_sample_delta == NULL )
{
MP4_FreeBox_stts( p_box );
goto error;
}
for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ ) for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
{ {
...@@ -807,13 +818,9 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -807,13 +818,9 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
p_box->data.p_stts->i_entry_count ); p_box->data.p_stts->i_entry_count );
#endif #endif
MP4_READBOX_EXIT( 1 ); code = 1;
} error:
MP4_READBOX_EXIT( code );
static void MP4_FreeBox_stts( MP4_Box_t *p_box )
{
FREENULL( p_box->data.p_stts->i_sample_count );
FREENULL( p_box->data.p_stts->i_sample_delta );
} }
static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box ) static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment