Commit 8d8617bb authored by Francois Cartegnie's avatar Francois Cartegnie Committed by Jean-Baptiste Kempf

demux: libmp4: fix heap buffer write ofw in chpl (fix #12366)

(cherry picked from commit d1bdd44b1902f62453f6982e1ee09a5b243f25ee)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
parent 448cc958
...@@ -2823,6 +2823,8 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -2823,6 +2823,8 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
uint64_t i_start; uint64_t i_start;
uint8_t i_len; uint8_t i_len;
int i_copy; int i_copy;
if ( i_read < 9 )
break;
MP4_GET8BYTES( i_start ); MP4_GET8BYTES( i_start );
MP4_GET1BYTE( i_len ); MP4_GET1BYTE( i_len );
...@@ -2839,6 +2841,10 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -2839,6 +2841,10 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
p_peek += i_copy; p_peek += i_copy;
i_read -= i_copy; i_read -= i_copy;
} }
if ( i != p_chpl->i_chapter )
p_chpl->i_chapter = i;
/* Bubble sort by increasing start date */ /* Bubble sort by increasing start date */
do do
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment