demux: mp4: set pointer to relase function into box

Possible could crash because release function was
not correctly matched du to missing parent id check.

Better save it into box instead of doing another lookup,
and because box could have been detached from parent.

modules/demux/mp4/libmp4.c

@@ -3677,6 +3677,8 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
         return NULL;
     }
 
+    p_box->pf_free = MP4_Box_Function[i_index].MP4_FreeBox_function;
+
     return p_box;
 }
 
@@ -3686,7 +3688,6 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
  *****************************************************************************/
 void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
 {
-    unsigned int i_index;
     MP4_Box_t    *p_child;
 
     if( !p_box )
@@ -3704,15 +3705,7 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
     /* Now search function to call */
     if( p_box->data.p_payload )
     {
-        for( i_index = 0; ; i_index++ )
-        {
-            if( ( MP4_Box_Function[i_index].i_type == p_box->i_type )||
-                ( MP4_Box_Function[i_index].i_type == 0 ) )
-            {
-                break;
-            }
-        }
-        if( MP4_Box_Function[i_index].MP4_FreeBox_function == NULL )
+        if (unlikely( p_box->pf_free == NULL ))
         {
             /* Should not happen */
             if MP4_BOX_TYPE_ASCII()
@@ -3726,7 +3719,7 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
         }
         else
         {
-            MP4_Box_Function[i_index].MP4_FreeBox_function( p_box );
+            p_box->pf_free( p_box );
         }
         free( p_box->data.p_payload );
     }

modules/demux/mp4/libmp4.h

@@ -1368,8 +1368,9 @@ typedef union MP4_Box_data_s
 
 
 
+typedef struct MP4_Box_s MP4_Box_t;
 /* the most basic structure */
-typedef struct MP4_Box_s
+struct MP4_Box_s
 {
     off_t        i_pos;      /* absolute position */
 
@@ -1397,7 +1398,8 @@ typedef struct MP4_Box_s
 
     struct MP4_Box_s *p_next;   /* pointer on the next boxes at the same level */
 
-} MP4_Box_t;
+    void (*pf_free)( MP4_Box_t *p_box ); /* pointer to free function for this box */
+};
 
 static inline size_t mp4_box_headersize( MP4_Box_t *p_box )
 {