Commit 26258915 authored by Francois Cartegnie's avatar Francois Cartegnie

demux: mp4: fix heap buffer overflow (fix #12266)

parent 223a42c1
...@@ -1762,6 +1762,8 @@ static int TrackCreateChunksIndex( demux_t *p_demux, ...@@ -1762,6 +1762,8 @@ static int TrackCreateChunksIndex( demux_t *p_demux,
i_last = BOXDATA(p_stsc)->i_first_chunk[i_index] - 1; i_last = BOXDATA(p_stsc)->i_first_chunk[i_index] - 1;
} }
if ( p_demux_track->i_chunk_count )
{
p_demux_track->chunk[0].i_sample_first = 0; p_demux_track->chunk[0].i_sample_first = 0;
for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ ) for( i_chunk = 1; i_chunk < p_demux_track->i_chunk_count; i_chunk++ )
{ {
...@@ -1769,6 +1771,7 @@ static int TrackCreateChunksIndex( demux_t *p_demux, ...@@ -1769,6 +1771,7 @@ static int TrackCreateChunksIndex( demux_t *p_demux,
p_demux_track->chunk[i_chunk-1].i_sample_first + p_demux_track->chunk[i_chunk-1].i_sample_first +
p_demux_track->chunk[i_chunk-1].i_sample_count; p_demux_track->chunk[i_chunk-1].i_sample_count;
} }
}
msg_Dbg( p_demux, "track[Id 0x%x] read %d chunk", msg_Dbg( p_demux, "track[Id 0x%x] read %d chunk",
p_demux_track->i_track_ID, p_demux_track->i_chunk_count ); p_demux_track->i_track_ID, p_demux_track->i_chunk_count );
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment