demux: libmp4: fix reading data atom

modules/demux/mp4/libmp4.c

@@ -2878,17 +2878,35 @@ static void MP4_FreeBox_String( MP4_Box_t *p_box )
 static int MP4_ReadBox_data( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_data_t );
+    MP4_Box_data_data_t *p_data = p_box->data.p_data;
 
-    /* What's that header ?? */
-    if ( i_read <= 8 )
+    if ( i_read < 8 || i_read - 8 > UINT32_MAX )
         MP4_READBOX_EXIT( 0 );
 
-    p_box->data.p_data->p_blob = malloc( i_read - 8 );
+    uint8_t i_type;
+    MP4_GET1BYTE( i_type );
+    if ( i_type != 0 )
+    {
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream, "skipping unknown 'data' atom with type %"PRIu8, i_type );
+#endif
+        MP4_READBOX_EXIT( 0 );
+    }
+
+    MP4_GET3BYTES( p_data->e_wellknowntype );
+    MP4_GET2BYTES( p_data->locale.i_country );
+    MP4_GET2BYTES( p_data->locale.i_language );
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream, "read 'data' atom: knowntype=%"PRIu32", country=%"PRIu16" lang=%"PRIu16
+                 ", size %"PRId64" bytes", p_data->e_wellknowntype,
+                 p_data->locale.i_country, p_data->locale.i_language, i_read );
+#endif
+    p_box->data.p_data->p_blob = malloc( i_read );
     if ( !p_box->data.p_data->p_blob )
         MP4_READBOX_EXIT( 0 );
 
-    p_box->data.p_data->i_blob = i_read - 8;
-    memcpy( p_box->data.p_data->p_blob, p_peek + 8, i_read - 8 );
+    p_box->data.p_data->i_blob = i_read;
+    memcpy( p_box->data.p_data->p_blob, p_peek, i_read);
 
     MP4_READBOX_EXIT( 1 );
 }

modules/demux/mp4/libmp4.h

@@ -1312,6 +1312,28 @@ typedef struct
 
 typedef struct
 {
+    enum
+    {
+        DATA_WKT_RESERVED = 0,
+        DATA_WKT_UTF8 = 1,
+        DATA_WKT_UTF16 = 2,
+        DATA_WKT_SJIS = 3,
+        DATA_WKT_UTF8_SORT = 4,
+        DATA_WKT_UTF16_SORT = 5,
+        DATA_WKT_JPEG = 13,
+        DATA_WKT_PNG = 14,
+        DATA_WKT_BE_SIGNED = 21,
+        DATA_WKT_BE_UNSIGNED = 22,
+        DATA_WKT_BE_FLOAT32 = 23,
+        DATA_WKT_BE_FLOAT64 = 24,
+        DATA_WKT_BMP = 27,
+        DATA_WKT_QUICKTIME_METADATA_ATOM = 28,
+    } e_wellknowntype;
+    struct
+    {
+        uint16_t i_country;
+        uint16_t i_language;
+    } locale;
     uint8_t *p_blob;
     uint32_t i_blob;
 } MP4_Box_data_data_t;