One more removing session. (useless test before a free())

[vlc] / modules / demux / mp4 / libmp4.c

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 5d25e0f05df3498f9f2a298f93b831a822e016e0..b28a98962271bb7b4b342dbae6f72479f951dbe7 100644 (file)
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -377,12 +377,16 @@ static int MP4_ReadBox_ftyp( stream_t *p_stream, MP4_Box_t *p_box )
     if( ( p_box->data.p_ftyp->i_compatible_brands_count = i_read / 4 ) )
     {
         unsigned int i;
-        p_box->data.p_ftyp->i_compatible_brands =
-            calloc( p_box->data.p_ftyp->i_compatible_brands_count, sizeof(uint32_t));
+        uint32_t *tab = p_box->data.p_ftyp->i_compatible_brands =
+            calloc( p_box->data.p_ftyp->i_compatible_brands_count,
+                    sizeof(uint32_t));
+
+        if( tab == NULL )
+            p_box->data.p_ftyp->i_compatible_brands_count = 0;
 
         for( i =0; i < p_box->data.p_ftyp->i_compatible_brands_count; i++ )
         {
-            MP4_GETFOURCC( p_box->data.p_ftyp->i_compatible_brands[i] );
+            MP4_GETFOURCC( tab[i] );
         }
     }
     else
@@ -788,9 +792,9 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stts->i_entry_count );
 
     p_box->data.p_stts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stts->i_sample_delta =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
 
     for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -822,9 +826,9 @@ static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_ctts->i_entry_count );
 
     p_box->data.p_ctts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_ctts->i_sample_offset =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
 
     for( i = 0; (i < p_box->data.p_ctts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -1204,8 +1208,7 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_box->i_type == FOURCC_alac )
     {
-        if( p_box->data.p_sample_soun->p_qt_description )
-            free( p_box->data.p_sample_soun->p_qt_description );
+        free( p_box->data.p_sample_soun->p_qt_description );
 
         p_box->data.p_sample_soun->p_qt_description = malloc( i_read );
         p_box->data.p_sample_soun->i_qt_description = i_read;
@@ -1447,7 +1450,7 @@ static int MP4_ReadBox_stsz( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsz->i_sample_count );
 
     p_box->data.p_stsz->i_entry_size =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsz->i_sample_count );
+        calloc( p_box->data.p_stsz->i_sample_count, sizeof(uint32_t) );
 
     if( !p_box->data.p_stsz->i_sample_size )
     {
@@ -1482,11 +1485,11 @@ static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsc->i_entry_count );
 
     p_box->data.p_stsc->i_first_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_samples_per_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_sample_description_index =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
 
     for( i = 0; (i < p_box->data.p_stsc->i_entry_count )&&( i_read >= 12 );i++ )
     {
@@ -1521,7 +1524,7 @@ static int MP4_ReadBox_stco_co64( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_co64->i_entry_count );
 
     p_box->data.p_co64->i_chunk_offset =
-        calloc( sizeof( uint64_t ), p_box->data.p_co64->i_entry_count );
+        calloc( p_box->data.p_co64->i_entry_count, sizeof(uint64_t) );
 
     for( i = 0; i < p_box->data.p_co64->i_entry_count; i++ )
     {
@@ -1567,7 +1570,7 @@ static int MP4_ReadBox_stss( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stss->i_entry_count );
 
     p_box->data.p_stss->i_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stss->i_entry_count );
+        calloc( p_box->data.p_stss->i_entry_count, sizeof(uint32_t) );
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 4 ); i++ )
     {
@@ -1602,10 +1605,10 @@ static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsh->i_entry_count );
 
     p_box->data.p_stsh->i_shadowed_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
 
     p_box->data.p_stsh->i_sync_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
 
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 8 ); i++ )
@@ -1638,7 +1641,7 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_stdp );
 
     p_box->data.p_stdp->i_priority =
-        calloc( sizeof( uint16_t ), i_read / 2 );
+        calloc( i_read / 2, sizeof(uint16_t) );
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
@@ -1661,7 +1664,9 @@ static void MP4_FreeBox_stdp( MP4_Box_t *p_box )
 
 static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
 {
+    int code = 0;
     unsigned int i;
+    uint32_t count;
 
     MP4_READBOX_ENTER( MP4_Box_data_padb_t );
 
@@ -1669,19 +1674,17 @@ static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
 
 
     MP4_GET4BYTES( p_box->data.p_padb->i_sample_count );
+    count = (p_box->data.p_padb->i_sample_count + 1) / 2;
 
-    p_box->data.p_padb->i_reserved1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_reserved2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-
+    p_box->data.p_padb->i_reserved1 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_reserved2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad1 = calloc( count, sizeof(uint16_t) );
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
+        if( i >= count )
+            goto error;
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 7 )&0x01;
         p_box->data.p_padb->i_pad2[i] = ( (*p_peek) >> 4 )&0x07;
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 3 )&0x01;
@@ -1695,7 +1698,9 @@ static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
                       i_read / 2 );
 
 #endif
-    MP4_READBOX_EXIT( 1 );
+    code = 1;
+error:
+    MP4_READBOX_EXIT( code );
 }
 
 static void MP4_FreeBox_padb( MP4_Box_t *p_box )
@@ -1718,13 +1723,13 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_elst->i_entry_count );
 
     p_box->data.p_elst->i_segment_duration =
-        calloc( sizeof( uint64_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_time =
-        calloc( sizeof( int64_t ),  p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_rate_integer =
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
     p_box->data.p_elst->i_media_rate_fraction=
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
 
 
     for( i = 0; i < p_box->data.p_elst->i_entry_count; i++ )
@@ -1978,10 +1983,14 @@ static int MP4_ReadBox_rdrf( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_rdrf );
     MP4_GETFOURCC( p_box->data.p_rdrf->i_ref_type );
     MP4_GET4BYTES( i_len );
+    i_len++;
+
     if( i_len > 0 )
     {
         uint32_t i;
-        p_box->data.p_rdrf->psz_ref = malloc( i_len  + 1);
+        p_box->data.p_rdrf->psz_ref = malloc( i_len );
+        i_len--;
+
         for( i = 0; i < i_len; i++ )
         {
             MP4_GET1BYTE( p_box->data.p_rdrf->psz_ref[i] );
@@ -2105,21 +2114,24 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_0xa9xxx( stream_t *p_stream, MP4_Box_t *p_box )
 {
-    uint16_t i_length, i_dummy;
+    uint16_t i16;
+    size_t i_length;
 
     MP4_READBOX_ENTER( MP4_Box_data_0xa9xxx_t );
 
     p_box->data.p_0xa9xxx->psz_text = NULL;
 
-    MP4_GET2BYTES( i_length );
+    MP4_GET2BYTES( i16 );
+    i_length = i16 + 1;
 
     if( i_length > 0 )
     {
-        MP4_GET2BYTES( i_dummy );
-        if( i_length > i_read ) i_length = i_read;
+        MP4_GET2BYTES( i16 );
+        if( i_length >= i_read ) i_length = i_read + 1;
 
-        p_box->data.p_0xa9xxx->psz_text = malloc( i_length + 1 );
+        p_box->data.p_0xa9xxx->psz_text = malloc( i_length );
 
+        i_length--;
         memcpy( p_box->data.p_0xa9xxx->psz_text,
                 p_peek, i_length );
         p_box->data.p_0xa9xxx->psz_text[i_length] = '\0';
@@ -2150,7 +2162,7 @@ static int MP4_ReadBox_0xa9xxx( stream_t *p_stream, MP4_Box_t *p_box )
             MP4_GET4BYTES( i_version );
             MP4_GET4BYTES( i_reserved );
             // version should be 0, flags should be 1 for text, 0 for data
-            if( i_version == 0x00000001 )
+            if( ( i_version == 0x00000001 ) && (i_data_len >= 12 ) )
             {
                 // the rest is the text
                 i_data_len -= 12;
@@ -2575,7 +2587,7 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
 
     if( !(MP4_Box_Function[i_index].MP4_ReadBox_function)( p_stream, p_box ) )
     {
-        free( p_box );
+        MP4_BoxFree( p_stream, p_box );
         return NULL;
     }