Commit 9cd23e9a authored by Francois Cartegnie's avatar Francois Cartegnie Committed by Jean-Baptiste Kempf

demux: mp4: fix heap buffer overflow (fix #12266)

(cherry picked from commit 26258915a956bd1150d4d369d476770af21c71b7)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
parent 3b8f4531
...@@ -1747,6 +1747,8 @@ static int TrackCreateChunksIndex( demux_t *p_demux, ...@@ -1747,6 +1747,8 @@ static int TrackCreateChunksIndex( demux_t *p_demux,
i_last = BOXDATA(p_stsc)->i_first_chunk[i_index] - 1; i_last = BOXDATA(p_stsc)->i_first_chunk[i_index] - 1;
} }
if ( p_demux_track->i_chunk_count )
{
p_demux_track->chunk[0].i_sample_first = 0; p_demux_track->chunk[0].i_sample_first = 0;
for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ ) for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ )
{ {
...@@ -1754,6 +1756,7 @@ static int TrackCreateChunksIndex( demux_t *p_demux, ...@@ -1754,6 +1756,7 @@ static int TrackCreateChunksIndex( demux_t *p_demux,
p_demux_track->chunk[i_chunk-1].i_sample_first + p_demux_track->chunk[i_chunk-1].i_sample_first +
p_demux_track->chunk[i_chunk-1].i_sample_count; p_demux_track->chunk[i_chunk-1].i_sample_count;
} }
}
msg_Dbg( p_demux, "track[Id 0x%x] read %d chunk", msg_Dbg( p_demux, "track[Id 0x%x] read %d chunk",
p_demux_track->i_track_ID, p_demux_track->i_chunk_count ); p_demux_track->i_track_ID, p_demux_track->i_chunk_count );
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment