MP4: fix off-by-one genre metadata reading

modules/demux/mp4/libmp4.c

@@ -1172,6 +1172,8 @@ static int MP4_ReadBox_gnre( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( i_version );
     MP4_GET4BYTES( i_reserved );
     MP4_GET2BYTES( p_gnre->i_genre );
+    if( p_gnre->i_genre == 0 )
+        MP4_READBOX_EXIT( 0 );
 #ifdef MP4_VERBOSE
     msg_Dbg( p_stream, "read box: \"gnre\" genre=%i", p_gnre->i_genre );
 #endif

modules/demux/mp4/mp4.c

@@ -905,8 +905,8 @@ static int Control( demux_t *p_demux, int i_query, va_list args )
                     break;
 
                 case FOURCC_gnre:
-                    if( p_0xa9xxx->data.p_gnre->i_genre < NUM_GENRES )
-                        vlc_meta_SetGenre( p_meta, ppsz_genres[p_0xa9xxx->data.p_gnre->i_genre] );
+                    if( p_0xa9xxx->data.p_gnre->i_genre <= NUM_GENRES )
+                        vlc_meta_SetGenre( p_meta, ppsz_genres[p_0xa9xxx->data.p_gnre->i_genre - 1] );
                     break;
 
                 case FOURCC_0xa9alb: /* Album */