Commit a92109bb authored by Francois Cartegnie's avatar Francois Cartegnie Committed by Jean-Baptiste Kempf

demux: mp4: don't read at all if not content

fixes 1 byte read overflow

(cherry picked from commit 2d07e7885945ef30a55a078d956e4b6714c5c1ee)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
parent f54f04d0
...@@ -1396,7 +1396,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -1396,7 +1396,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
if( !p_avcC->i_sps_length || !p_avcC->sps ) if( !p_avcC->i_sps_length || !p_avcC->sps )
goto error; goto error;
for( i = 0; i < p_avcC->i_sps && i_read; i++ ) for( i = 0; i < p_avcC->i_sps && i_read > 2; i++ )
{ {
MP4_GET2BYTES( p_avcC->i_sps_length[i] ); MP4_GET2BYTES( p_avcC->i_sps_length[i] );
if ( p_avcC->i_sps_length[i] > i_read ) if ( p_avcC->i_sps_length[i] > i_read )
...@@ -1421,7 +1421,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box ) ...@@ -1421,7 +1421,7 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
if( !p_avcC->i_pps_length || !p_avcC->pps ) if( !p_avcC->i_pps_length || !p_avcC->pps )
goto error; goto error;
for( i = 0; i < p_avcC->i_pps && i_read; i++ ) for( i = 0; i < p_avcC->i_pps && i_read > 2; i++ )
{ {
MP4_GET2BYTES( p_avcC->i_pps_length[i] ); MP4_GET2BYTES( p_avcC->i_pps_length[i] );
if( p_avcC->i_pps_length[i] > i_read ) if( p_avcC->i_pps_length[i] > i_read )
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment