X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=modules%2Fdemux%2Fmp4%2Flibmp4.c;h=b6f860f9f224535eb53f454eef696497b29beb93;hb=d254e4ff8e8f396969d863f23f991e64d729065d;hp=6fe3657d823bdb4df37bce0b0d62329010b08c26;hpb=80af71f72f1ac98a372f8a75ebca09d3430c7192;p=vlc

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 6fe3657d82..b6f860f9f2 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -1,7 +1,7 @@
 /*****************************************************************************
  * libmp4.c : LibMP4 library for mp4 module for vlc
  *****************************************************************************
- * Copyright (C) 2001-2004 the VideoLAN team
+ * Copyright (C) 2001-2004, 2010 the VideoLAN team
  * $Id$
  *
  * Author: Laurent Aimar <fenrir@via.ecp.fr>
@@ -20,13 +20,12 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  *****************************************************************************/
+
 #ifdef HAVE_CONFIG_H
 # include "config.h"
 #endif
 
-#include <vlc/vlc.h>
-
-
+#include <vlc_common.h>
 #include <vlc_demux.h>
 
 #ifdef HAVE_ZLIB_H
@@ -38,9 +37,10 @@
 
 /*****************************************************************************
  * Here are defined some macro to make life simpler but before using it
- *  *look* at the code.
+ * *look* at the code.
  *
  *****************************************************************************/
+
 #define MP4_BOX_HEADERSIZE( p_box )             \
   ( 8 + ( p_box->i_shortsize == 1 ? 8 : 0 )     \
       + ( p_box->i_type == FOURCC_uuid ? 16 : 0 ) )
@@ -68,8 +68,11 @@
     {       \
         const int __i_copy__ = strnlen( (char*)p_peek, i_read-1 );  \
         p_str = malloc( __i_copy__+1 );               \
-        if( __i_copy__ > 0 ) memcpy( p_str, p_peek, __i_copy__ );   \
-        p_str[__i_copy__] = 0;      \
+        if( p_str ) \
+        { \
+             memcpy( p_str, p_peek, __i_copy__ ); \
+             p_str[__i_copy__] = 0; \
+        } \
         p_peek += __i_copy__ + 1;   \
         i_read -= __i_copy__ + 1;   \
     }       \
@@ -94,23 +97,24 @@
     } \
     p_peek += MP4_BOX_HEADERSIZE( p_box ); \
     i_read -= MP4_BOX_HEADERSIZE( p_box ); \
-    if( !( p_box->data.p_data = malloc( sizeof( MP4_Box_data_TYPE_t ) ) ) ) \
+    if( !( p_box->data.p_data = calloc( 1, sizeof( MP4_Box_data_TYPE_t ) ) ) ) \
     { \
       free( p_buff ); \
       return( 0 ); \
     }
 
 #define MP4_READBOX_EXIT( i_code ) \
-    free( p_buff ); \
-    if( i_read < 0 ) \
+    do \
     { \
-        msg_Warn( p_stream, "Not enough data" ); \
-    } \
-    return( i_code )
+        free( p_buff ); \
+        if( i_read < 0 ) \
+            msg_Warn( p_stream, "Not enough data" ); \
+        return( i_code ); \
+    } while (0)
 
 
 /* Some assumptions:
-        * The input method HAVE to be seekable
+ * The input method HAS to be seekable
 
 */
 
@@ -150,7 +154,7 @@ static void MP4_ConvertDate2Str( char *psz, uint64_t i_date )
     int i_sec;
 
     /* date begin at 1 jan 1904 */
-    i_date += ((I64C(1904) * 365) + 17) * 24 * 60 * 60;
+    i_date += ((INT64_C(1904) * 365) + 17) * 24 * 60 * 60;
 
     i_day = i_date / ( 60*60*24);
     i_hour = ( i_date /( 60*60 ) ) % 60;
@@ -220,10 +224,10 @@ int MP4_ReadBoxCommon( stream_t *p_stream, MP4_Box_t *p_box )
     if( p_box->i_size )
     {
         if MP4_BOX_TYPE_ASCII()
-            msg_Dbg( p_stream, "found Box: %4.4s size "I64Fd,
+            msg_Dbg( p_stream, "found Box: %4.4s size %"PRId64,
                     (char*)&p_box->i_type, p_box->i_size );
         else
-            msg_Dbg( p_stream, "found Box: c%3.3s size "I64Fd,
+            msg_Dbg( p_stream, "found Box: c%3.3s size %"PRId64,
                     (char*)&p_box->i_type+1, p_box->i_size );
     }
 #endif
@@ -253,8 +257,8 @@ static int MP4_NextBox( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_box->p_father )
     {
-        const int i_box_end = p_box->i_size + p_box->i_pos;
-        const int i_father_end = p_box->p_father->i_size + p_box->p_father->i_pos;
+        const off_t i_box_end = p_box->i_size + p_box->i_pos;
+        const off_t i_father_end = p_box->p_father->i_size + p_box->p_father->i_pos;
 
         /* check if it's within p-father */
         if( i_box_end >= i_father_end )
@@ -374,12 +378,16 @@ static int MP4_ReadBox_ftyp( stream_t *p_stream, MP4_Box_t *p_box )
     if( ( p_box->data.p_ftyp->i_compatible_brands_count = i_read / 4 ) )
     {
         unsigned int i;
-        p_box->data.p_ftyp->i_compatible_brands =
-            calloc( p_box->data.p_ftyp->i_compatible_brands_count, sizeof(uint32_t));
+        uint32_t *tab = p_box->data.p_ftyp->i_compatible_brands =
+            calloc( p_box->data.p_ftyp->i_compatible_brands_count,
+                    sizeof(uint32_t));
+
+        if( tab == NULL )
+            MP4_READBOX_EXIT( 0 );
 
         for( i =0; i < p_box->data.p_ftyp->i_compatible_brands_count; i++ )
         {
-            MP4_GETFOURCC( p_box->data.p_ftyp->i_compatible_brands[i] );
+            MP4_GETFOURCC( tab[i] );
         }
     }
     else
@@ -559,7 +567,7 @@ static int MP4_ReadBox_mdhd( stream_t *p_stream, MP4_Box_t *p_box )
         MP4_GET4BYTES( p_box->data.p_mdhd->i_timescale );
         MP4_GET4BYTES( p_box->data.p_mdhd->i_duration );
     }
-    i_language = GetWBE( p_peek );
+    p_box->data.p_mdhd->i_language_code = i_language = GetWBE( p_peek );
     for( i = 0; i < 3; i++ )
     {
         p_box->data.p_mdhd->i_language[i] =
@@ -603,7 +611,9 @@ static int MP4_ReadBox_hdlr( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( i_read > 0 )
     {
-        p_box->data.p_hdlr->psz_name = malloc( i_read + 1 );
+        uint8_t *psz = p_box->data.p_hdlr->psz_name = malloc( i_read + 1 );
+        if( psz == NULL )
+            MP4_READBOX_EXIT( 0 );
 
         /* Yes, I love .mp4 :( */
         if( p_box->data.p_hdlr->i_predefined == VLC_FOURCC( 'm', 'h', 'l', 'r' ) )
@@ -614,12 +624,12 @@ static int MP4_ReadBox_hdlr( stream_t *p_stream, MP4_Box_t *p_box )
             MP4_GET1BYTE( i_len );
             i_copy = __MIN( i_read, i_len );
 
-            memcpy( p_box->data.p_hdlr->psz_name, p_peek, i_copy );
+            memcpy( psz, p_peek, i_copy );
             p_box->data.p_hdlr->psz_name[i_copy] = '\0';
         }
         else
         {
-            memcpy( p_box->data.p_hdlr->psz_name, p_peek, i_read );
+            memcpy( psz, p_peek, i_read );
             p_box->data.p_hdlr->psz_name[i_read] = '\0';
         }
     }
@@ -769,6 +779,11 @@ static int MP4_ReadBox_dref( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
+static void MP4_FreeBox_stts( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stts->i_sample_count );
+    FREENULL( p_box->data.p_stts->i_sample_delta );
+}
 
 static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -779,9 +794,14 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stts->i_entry_count );
 
     p_box->data.p_stts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stts->i_sample_delta =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stts->i_sample_count == NULL
+     || p_box->data.p_stts->i_sample_delta == NULL )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -797,10 +817,11 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stts( MP4_Box_t *p_box )
+
+static void MP4_FreeBox_ctts( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_stts->i_sample_count );
-    FREENULL( p_box->data.p_stts->i_sample_delta );
+    FREENULL( p_box->data.p_ctts->i_sample_count );
+    FREENULL( p_box->data.p_ctts->i_sample_offset );
 }
 
 static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
@@ -813,9 +834,14 @@ static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_ctts->i_entry_count );
 
     p_box->data.p_ctts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_ctts->i_sample_offset =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
+    if( ( p_box->data.p_ctts->i_sample_count == NULL )
+     || ( p_box->data.p_ctts->i_sample_offset == NULL ) )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_ctts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -831,11 +857,6 @@ static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_ctts( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_ctts->i_sample_count );
-    FREENULL( p_box->data.p_ctts->i_sample_offset );
-}
 
 static int MP4_ReadLengthDescriptor( uint8_t **pp_peek, int64_t  *i_read )
 {
@@ -852,6 +873,17 @@ static int MP4_ReadLengthDescriptor( uint8_t **pp_peek, int64_t  *i_read )
     return( i_len );
 }
 
+
+static void MP4_FreeBox_esds( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_esds->es_descriptor.psz_URL );
+    if( p_box->data.p_esds->es_descriptor.p_decConfigDescr )
+    {
+        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr->p_decoder_specific_info );
+        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr );
+    }
+}
+
 static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 {
 #define es_descriptor p_box->data.p_esds->es_descriptor
@@ -891,8 +923,11 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 
             MP4_GET1BYTE( i_len );
             es_descriptor.psz_URL = malloc( i_len + 1 );
-            memcpy( es_descriptor.psz_URL, p_peek, i_len );
-            es_descriptor.psz_URL[i_len] = 0;
+            if( es_descriptor.psz_URL )
+            {
+                memcpy( es_descriptor.psz_URL, p_peek, i_len );
+                es_descriptor.psz_URL[i_len] = 0;
+            }
             p_peek += i_len;
             i_read -= i_len;
         }
@@ -921,7 +956,9 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 #endif
 
     es_descriptor.p_decConfigDescr =
-            malloc( sizeof( MP4_descriptor_decoder_config_t ));
+            calloc( 1, sizeof( MP4_descriptor_decoder_config_t ));
+    if( es_descriptor.p_decConfigDescr == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     MP4_GET1BYTE( es_descriptor.p_decConfigDescr->i_objectTypeIndication );
     MP4_GET1BYTE( i_flags );
@@ -944,25 +981,42 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
         msg_Dbg( p_stream, "found esds MP4DecSpecificDescr (%dBytes)",
                  i_len );
 #endif
+    if( i_len > i_read )
+        MP4_READBOX_EXIT( 0 );
 
     es_descriptor.p_decConfigDescr->i_decoder_specific_info_len = i_len;
     es_descriptor.p_decConfigDescr->p_decoder_specific_info = malloc( i_len );
+    if( es_descriptor.p_decConfigDescr->p_decoder_specific_info == NULL )
+        MP4_READBOX_EXIT( 0 );
+
     memcpy( es_descriptor.p_decConfigDescr->p_decoder_specific_info,
             p_peek, i_len );
 
     MP4_READBOX_EXIT( 1 );
-
 #undef es_descriptor
 }
 
-static void MP4_FreeBox_esds( MP4_Box_t *p_box )
+static void MP4_FreeBox_avcC( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_esds->es_descriptor.psz_URL );
-    if( p_box->data.p_esds->es_descriptor.p_decConfigDescr )
+    MP4_Box_data_avcC_t *p_avcC = p_box->data.p_avcC;
+    int i;
+
+    if( p_avcC->i_avcC > 0 ) FREENULL( p_avcC->p_avcC );
+
+    if( p_avcC->sps )
     {
-        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr->p_decoder_specific_info );
+        for( i = 0; i < p_avcC->i_sps; i++ )
+            FREENULL( p_avcC->sps[i] );
     }
-    FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr );
+    if( p_avcC->pps )
+    {
+        for( i = 0; i < p_avcC->i_pps; i++ )
+            FREENULL( p_avcC->pps[i] );
+    }
+    if( p_avcC->i_sps > 0 ) FREENULL( p_avcC->sps );
+    if( p_avcC->i_sps > 0 ) FREENULL( p_avcC->i_sps_length );
+    if( p_avcC->i_pps > 0 ) FREENULL( p_avcC->pps );
+    if( p_avcC->i_pps > 0 ) FREENULL( p_avcC->i_pps_length );
 }
 
 static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
@@ -976,8 +1030,9 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
     p_avcC->i_avcC = i_read;
     if( p_avcC->i_avcC > 0 )
     {
-        p_avcC->p_avcC = malloc( p_avcC->i_avcC );
-        memcpy( p_avcC->p_avcC, p_peek, i_read );
+        uint8_t * p = p_avcC->p_avcC = malloc( p_avcC->i_avcC );
+        if( p )
+            memcpy( p, p_peek, i_read );
     }
 
     MP4_GET1BYTE( p_avcC->i_version );
@@ -994,14 +1049,18 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_avcC->i_sps > 0 )
     {
-        p_avcC->i_sps_length = malloc( p_avcC->i_sps * sizeof( uint16_t ) );
-        p_avcC->sps = malloc( p_avcC->i_sps * sizeof( uint8_t* ) );
+        p_avcC->i_sps_length = calloc( p_avcC->i_sps, sizeof( uint16_t ) );
+        p_avcC->sps = calloc( p_avcC->i_sps, sizeof( uint8_t* ) );
+
+        if( !p_avcC->i_sps_length || !p_avcC->sps )
+            goto error;
 
         for( i = 0; i < p_avcC->i_sps; i++ )
         {
             MP4_GET2BYTES( p_avcC->i_sps_length[i] );
             p_avcC->sps[i] = malloc( p_avcC->i_sps_length[i] );
-            memcpy( p_avcC->sps[i], p_peek, p_avcC->i_sps_length[i] );
+            if( p_avcC->sps[i] )
+                memcpy( p_avcC->sps[i], p_peek, p_avcC->i_sps_length[i] );
 
             p_peek += p_avcC->i_sps_length[i];
             i_read -= p_avcC->i_sps_length[i];
@@ -1011,14 +1070,18 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET1BYTE( p_avcC->i_pps );
     if( p_avcC->i_pps > 0 )
     {
-        p_avcC->i_pps_length = malloc( p_avcC->i_pps * sizeof( uint16_t ) );
-        p_avcC->pps = malloc( p_avcC->i_pps * sizeof( uint8_t* ) );
+        p_avcC->i_pps_length = calloc( p_avcC->i_pps, sizeof( uint16_t ) );
+        p_avcC->pps = calloc( p_avcC->i_pps, sizeof( uint8_t* ) );
+
+        if( !p_avcC->i_pps_length || !p_avcC->pps )
+            goto error;
 
         for( i = 0; i < p_avcC->i_pps; i++ )
         {
             MP4_GET2BYTES( p_avcC->i_pps_length[i] );
             p_avcC->pps[i] = malloc( p_avcC->i_pps_length[i] );
-            memcpy( p_avcC->pps[i], p_peek, p_avcC->i_pps_length[i] );
+            if( p_avcC->pps[i] )
+                memcpy( p_avcC->pps[i], p_peek, p_avcC->i_pps_length[i] );
 
             p_peek += p_avcC->i_pps_length[i];
             i_read -= p_avcC->i_pps_length[i];
@@ -1043,29 +1106,116 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
 
 #endif
     MP4_READBOX_EXIT( 1 );
+
+error:
+    MP4_READBOX_EXIT( 0 );
 }
 
-static void MP4_FreeBox_avcC( MP4_Box_t *p_box )
+static int MP4_ReadBox_dac3( stream_t *p_stream, MP4_Box_t *p_box )
 {
-    MP4_Box_data_avcC_t *p_avcC = p_box->data.p_avcC;
-    int i;
+    MP4_Box_data_dac3_t *p_dac3;
+    MP4_READBOX_ENTER( MP4_Box_data_dac3_t );
 
-    if( p_avcC->i_avcC > 0 ) FREENULL( p_avcC->p_avcC );
+    p_dac3 = p_box->data.p_dac3;
 
-    for( i = 0; i < p_avcC->i_sps; i++ )
-    {
-        FREENULL( p_avcC->sps[i] );
-    }
-    for( i = 0; i < p_avcC->i_pps; i++ )
+    unsigned i_header;
+    MP4_GET3BYTES( i_header );
+
+    p_dac3->i_fscod = ( i_header >> 22 ) & 0x03;
+    p_dac3->i_bsid  = ( i_header >> 17 ) & 0x01f;
+    p_dac3->i_bsmod = ( i_header >> 14 ) & 0x07;
+    p_dac3->i_acmod = ( i_header >> 11 ) & 0x07;
+    p_dac3->i_lfeon = ( i_header >> 10 ) & 0x01;
+    p_dac3->i_bitrate_code = ( i_header >> 5) & 0x1f;
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream,
+             "read box: \"dac3\" fscod=0x%x bsid=0x%x bsmod=0x%x acmod=0x%x lfeon=0x%x bitrate_code=0x%x",
+             p_dac3->i_fscod, p_dac3->i_bsid, p_dac3->i_bsmod, p_dac3->i_acmod, p_dac3->i_lfeon, p_dac3->i_bitrate_code );
+#endif
+    MP4_READBOX_EXIT( 1 );
+}
+
+static int MP4_ReadBox_enda( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_Box_data_enda_t *p_enda;
+    MP4_READBOX_ENTER( MP4_Box_data_enda_t );
+
+    p_enda = p_box->data.p_enda;
+
+    MP4_GET2BYTES( p_enda->i_little_endian );
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream,
+             "read box: \"enda\" little_endian=%d", p_enda->i_little_endian );
+#endif
+    MP4_READBOX_EXIT( 1 );
+}
+
+static int MP4_ReadBox_gnre( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_Box_data_gnre_t *p_gnre;
+    MP4_READBOX_ENTER( MP4_Box_data_gnre_t );
+
+    p_gnre = p_box->data.p_gnre;
+
+    uint32_t i_data_len;
+    uint32_t i_data_tag;
+
+    MP4_GET4BYTES( i_data_len );
+    MP4_GETFOURCC( i_data_tag );
+    if( i_data_len < 10 || i_data_tag != VLC_FOURCC('d', 'a', 't', 'a') )
+        MP4_READBOX_EXIT( 0 );
+
+    uint32_t i_version;
+    uint32_t i_reserved;
+    MP4_GET4BYTES( i_version );
+    MP4_GET4BYTES( i_reserved );
+    MP4_GET2BYTES( p_gnre->i_genre );
+    if( p_gnre->i_genre == 0 )
+        MP4_READBOX_EXIT( 0 );
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"gnre\" genre=%i", p_gnre->i_genre );
+#endif
+
+    MP4_READBOX_EXIT( 1 );
+}
+
+static int MP4_ReadBox_trkn( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_Box_data_trkn_t *p_trkn;
+    MP4_READBOX_ENTER( MP4_Box_data_trkn_t );
+
+    p_trkn = p_box->data.p_trkn;
+
+    uint32_t i_data_len;
+    uint32_t i_data_tag;
+
+    MP4_GET4BYTES( i_data_len );
+    MP4_GETFOURCC( i_data_tag );
+    if( i_data_len < 12 || i_data_tag != VLC_FOURCC('d', 'a', 't', 'a') )
+        MP4_READBOX_EXIT( 0 );
+
+    uint32_t i_version;
+    uint32_t i_reserved;
+    MP4_GET4BYTES( i_version );
+    MP4_GET4BYTES( i_reserved );
+    MP4_GET4BYTES( p_trkn->i_track_number );
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"trkn\" number=%i", p_trkn->i_track_number );
+#endif
+    if( i_data_len > 15 )
     {
-        FREENULL( p_avcC->pps[i] );
+       MP4_GET4BYTES( p_trkn->i_track_total );
+#ifdef MP4_VERBOSE
+       msg_Dbg( p_stream, "read box: \"trkn\" total=%i", p_trkn->i_track_total );
+#endif
     }
-    if( p_avcC->i_sps > 0 ) FREENULL( p_avcC->sps );
-    if( p_avcC->i_sps > 0 ) FREENULL( p_avcC->i_sps_length );
-    if( p_avcC->i_pps > 0 ) FREENULL( p_avcC->pps );
-    if( p_avcC->i_pps > 0 ) FREENULL( p_avcC->i_pps_length );
+
+    MP4_READBOX_EXIT( 1 );
 }
 
+
 static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1091,16 +1241,16 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
     /*
      * XXX hack -> produce a copy of the nearly complete chunk
      */
+    p_box->data.p_sample_soun->i_qt_description = 0;
+    p_box->data.p_sample_soun->p_qt_description = NULL;
     if( i_read > 0 )
     {
-        p_box->data.p_sample_soun->i_qt_description = i_read;
         p_box->data.p_sample_soun->p_qt_description = malloc( i_read );
-        memcpy( p_box->data.p_sample_soun->p_qt_description, p_peek, i_read );
-    }
-    else
-    {
-        p_box->data.p_sample_soun->i_qt_description = 0;
-        p_box->data.p_sample_soun->p_qt_description = NULL;
+        if( p_box->data.p_sample_soun->p_qt_description )
+        {
+            p_box->data.p_sample_soun->i_qt_description = i_read;
+            memcpy( p_box->data.p_sample_soun->p_qt_description, p_peek, i_read );
+        }
     }
 
     MP4_GET2BYTES( p_box->data.p_sample_soun->i_qt_version );
@@ -1138,12 +1288,12 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
     {
         /* SoundDescriptionV2 */
         double f_sample_rate;
-    int64_t dummy;
+        int64_t dummy;
         uint32_t i_channel;
 
         MP4_GET4BYTES( p_box->data.p_sample_soun->i_sample_per_packet );
         MP4_GET8BYTES( dummy );
-    memcpy( &f_sample_rate, &dummy, 8 );
+        memcpy( &f_sample_rate, &dummy, 8 );
 
         msg_Dbg( p_stream, "read box: %f Hz", f_sample_rate );
         p_box->data.p_sample_soun->i_sampleratehi = (int)f_sample_rate % 65536;
@@ -1165,7 +1315,7 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
         p_box->data.p_sample_soun->i_bytes_per_frame = 0;
         p_box->data.p_sample_soun->i_bytes_per_sample = 0;
 
-        msg_Dbg( p_stream, "read box: \"soun\" mp4 or qt1/2 (rest="I64Fd")",
+        msg_Dbg( p_stream, "read box: \"soun\" mp4 or qt1/2 (rest=%"PRId64")",
                  i_read );
         stream_Seek( p_stream, p_box->i_pos +
                         MP4_BOX_HEADERSIZE( p_box ) + 28 );
@@ -1173,12 +1323,12 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_box->i_type == FOURCC_drms )
     {
-        p_box->data.p_sample_soun->p_drms =
-            drms_alloc( p_stream->p_libvlc->psz_homedir );
-
-        if( p_box->data.p_sample_soun->p_drms == NULL )
+        char *home = config_GetUserDir( VLC_HOME_DIR );
+        if( home != NULL )
         {
-            msg_Err( p_stream, "drms_alloc() failed" );
+            p_box->data.p_sample_soun->p_drms = drms_alloc( home );
+            if( p_box->data.p_sample_soun->p_drms == NULL )
+                msg_Err( p_stream, "drms_alloc() failed" );
         }
     }
 
@@ -1188,19 +1338,7 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
         p_box->data.p_sample_soun->i_channelcount = 1;
     }
 
-    if( p_box->i_type == FOURCC_alac )
-    {
-        if( p_box->data.p_sample_soun->p_qt_description )
-            free( p_box->data.p_sample_soun->p_qt_description );
-
-        p_box->data.p_sample_soun->p_qt_description = malloc( i_read );
-        p_box->data.p_sample_soun->i_qt_description = i_read;
-        memcpy( p_box->data.p_sample_soun->p_qt_description, p_peek, i_read );
-    }
-    else
-    {
-        MP4_ReadBoxContainerRaw( p_stream, p_box ); /* esds */
-    }
+    MP4_ReadBoxContainerRaw( p_stream, p_box ); /* esds/wave/... */
 
 #ifdef MP4_VERBOSE
     msg_Dbg( p_stream, "read box: \"soun\" in stsd channel %d "
@@ -1247,8 +1385,10 @@ int MP4_ReadBox_sample_vide( stream_t *p_stream, MP4_Box_t *p_box )
      */
     if( i_read > 0 )
     {
-        p_box->data.p_sample_vide->i_qt_image_description = i_read;
         p_box->data.p_sample_vide->p_qt_image_description = malloc( i_read );
+        if( p_box->data.p_sample_vide->p_qt_image_description == NULL )
+            MP4_READBOX_EXIT( 0 );
+        p_box->data.p_sample_vide->i_qt_image_description = i_read;
         memcpy( p_box->data.p_sample_vide->p_qt_image_description,
                 p_peek, i_read );
     }
@@ -1281,6 +1421,18 @@ int MP4_ReadBox_sample_vide( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET2BYTES( p_box->data.p_sample_vide->i_qt_color_table );
 
     stream_Seek( p_stream, p_box->i_pos + MP4_BOX_HEADERSIZE( p_box ) + 78);
+
+    if( p_box->i_type == FOURCC_drmi )
+    {
+        char *home = config_GetUserDir( VLC_HOME_DIR );
+        if( home != NULL )
+        {
+            p_box->data.p_sample_vide->p_drms = drms_alloc( home );
+            if( p_box->data.p_sample_vide->p_drms == NULL )
+                msg_Err( p_stream, "drms_alloc() failed" );
+        }
+    }
+
     MP4_ReadBoxContainerRaw( p_stream, p_box );
 
 #ifdef MP4_VERBOSE
@@ -1297,6 +1449,14 @@ int MP4_ReadBox_sample_vide( stream_t *p_stream, MP4_Box_t *p_box )
 void MP4_FreeBox_sample_vide( MP4_Box_t *p_box )
 {
     FREENULL( p_box->data.p_sample_vide->p_qt_image_description );
+
+    if( p_box->i_type == FOURCC_drmi )
+    {
+        if( p_box->data.p_sample_vide->p_drms )
+        {
+            drms_free( p_box->data.p_sample_vide->p_drms );
+        }
+    }
 }
 
 static int MP4_ReadBox_sample_mp4s( stream_t *p_stream, MP4_Box_t *p_box )
@@ -1383,7 +1543,7 @@ static int MP4_ReadBox_sample_tx3g( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET2BYTES( p_box->data.p_sample_text->i_text_box_right );
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"text\" in stsd text" );
+    msg_Dbg( p_stream, "read box: \"tx3g\" in stsd text" );
 #endif
     MP4_READBOX_EXIT( 1 );
 }
@@ -1433,7 +1593,9 @@ static int MP4_ReadBox_stsz( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsz->i_sample_count );
 
     p_box->data.p_stsz->i_entry_size =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsz->i_sample_count );
+        calloc( p_box->data.p_stsz->i_sample_count, sizeof(uint32_t) );
+    if( p_box->data.p_stsz->i_entry_size == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     if( !p_box->data.p_stsz->i_sample_size )
     {
@@ -1457,6 +1619,13 @@ static void MP4_FreeBox_stsz( MP4_Box_t *p_box )
     FREENULL( p_box->data.p_stsz->i_entry_size );
 }
 
+static void MP4_FreeBox_stsc( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stsc->i_first_chunk );
+    FREENULL( p_box->data.p_stsc->i_samples_per_chunk );
+    FREENULL( p_box->data.p_stsc->i_sample_description_index );
+}
+
 static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1468,11 +1637,17 @@ static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsc->i_entry_count );
 
     p_box->data.p_stsc->i_first_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_samples_per_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_sample_description_index =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stsc->i_first_chunk == NULL
+     || p_box->data.p_stsc->i_samples_per_chunk == NULL
+     || p_box->data.p_stsc->i_sample_description_index == NULL )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stsc->i_entry_count )&&( i_read >= 12 );i++ )
     {
@@ -1489,13 +1664,6 @@ static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stsc( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_stsc->i_first_chunk );
-    FREENULL( p_box->data.p_stsc->i_samples_per_chunk );
-    FREENULL( p_box->data.p_stsc->i_sample_description_index );
-}
-
 static int MP4_ReadBox_stco_co64( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1507,7 +1675,9 @@ static int MP4_ReadBox_stco_co64( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_co64->i_entry_count );
 
     p_box->data.p_co64->i_chunk_offset =
-        calloc( sizeof( uint64_t ), p_box->data.p_co64->i_entry_count );
+        calloc( p_box->data.p_co64->i_entry_count, sizeof(uint64_t) );
+    if( p_box->data.p_co64->i_chunk_offset == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     for( i = 0; i < p_box->data.p_co64->i_entry_count; i++ )
     {
@@ -1553,7 +1723,9 @@ static int MP4_ReadBox_stss( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stss->i_entry_count );
 
     p_box->data.p_stss->i_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stss->i_entry_count );
+        calloc( p_box->data.p_stss->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stss->i_sample_number == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 4 ); i++ )
     {
@@ -1576,6 +1748,12 @@ static void MP4_FreeBox_stss( MP4_Box_t *p_box )
     FREENULL( p_box->data.p_stss->i_sample_number );
 }
 
+static void MP4_FreeBox_stsh( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stsh->i_shadowed_sample_number );
+    FREENULL( p_box->data.p_stsh->i_sync_sample_number );
+}
+
 static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1588,11 +1766,15 @@ static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsh->i_entry_count );
 
     p_box->data.p_stsh->i_shadowed_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
-
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsh->i_sync_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
 
+    if( p_box->data.p_stsh->i_shadowed_sample_number == NULL
+     || p_box->data.p_stsh->i_sync_sample_number == NULL )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 8 ); i++ )
     {
@@ -1608,12 +1790,6 @@ static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stsh( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_stsh->i_shadowed_sample_number );
-    FREENULL( p_box->data.p_stsh->i_sync_sample_number );
-}
-
 
 static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -1624,7 +1800,7 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_stdp );
 
     p_box->data.p_stdp->i_priority =
-        calloc( sizeof( uint16_t ), i_read / 2 );
+        calloc( i_read / 2, sizeof(uint16_t) );
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
@@ -1633,7 +1809,7 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
+    msg_Dbg( p_stream, "read box: \"stdp\" entry-count %"PRId64,
                       i_read / 2 );
 
 #endif
@@ -1645,29 +1821,44 @@ static void MP4_FreeBox_stdp( MP4_Box_t *p_box )
     FREENULL( p_box->data.p_stdp->i_priority );
 }
 
+static void MP4_FreeBox_padb( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_padb->i_reserved1 );
+    FREENULL( p_box->data.p_padb->i_pad2 );
+    FREENULL( p_box->data.p_padb->i_reserved2 );
+    FREENULL( p_box->data.p_padb->i_pad1 );
+}
+
 static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
+    uint32_t count;
 
     MP4_READBOX_ENTER( MP4_Box_data_padb_t );
 
     MP4_GETVERSIONFLAGS( p_box->data.p_padb );
 
-
     MP4_GET4BYTES( p_box->data.p_padb->i_sample_count );
+    count = (p_box->data.p_padb->i_sample_count + 1) / 2;
 
-    p_box->data.p_padb->i_reserved1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_reserved2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-
+    p_box->data.p_padb->i_reserved1 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_reserved2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad1 = calloc( count, sizeof(uint16_t) );
+    if( p_box->data.p_padb->i_reserved1 == NULL
+     || p_box->data.p_padb->i_pad2 == NULL
+     || p_box->data.p_padb->i_reserved2 == NULL
+     || p_box->data.p_padb->i_pad1 == NULL )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
+        if( i >= count )
+        {
+            MP4_READBOX_EXIT( 0 );
+        }
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 7 )&0x01;
         p_box->data.p_padb->i_pad2[i] = ( (*p_peek) >> 4 )&0x07;
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 3 )&0x01;
@@ -1677,19 +1868,19 @@ static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
+    msg_Dbg( p_stream, "read box: \"stdp\" entry-count %"PRId64,
                       i_read / 2 );
 
 #endif
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_padb( MP4_Box_t *p_box )
+static void MP4_FreeBox_elst( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_padb->i_reserved1 );
-    FREENULL( p_box->data.p_padb->i_pad2 );
-    FREENULL( p_box->data.p_padb->i_reserved2 );
-    FREENULL( p_box->data.p_padb->i_pad1 );
+    FREENULL( p_box->data.p_elst->i_segment_duration );
+    FREENULL( p_box->data.p_elst->i_media_time );
+    FREENULL( p_box->data.p_elst->i_media_rate_integer );
+    FREENULL( p_box->data.p_elst->i_media_rate_fraction );
 }
 
 static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
@@ -1704,13 +1895,20 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_elst->i_entry_count );
 
     p_box->data.p_elst->i_segment_duration =
-        calloc( sizeof( uint64_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_time =
-        calloc( sizeof( int64_t ),  p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_rate_integer =
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
-    p_box->data.p_elst->i_media_rate_fraction=
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
+    p_box->data.p_elst->i_media_rate_fraction =
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
+    if( p_box->data.p_elst->i_segment_duration == NULL
+     || p_box->data.p_elst->i_media_time == NULL
+     || p_box->data.p_elst->i_media_rate_integer == NULL
+     || p_box->data.p_elst->i_media_rate_fraction == NULL )
+    {
+        MP4_READBOX_EXIT( 0 );
+    }
 
 
     for( i = 0; i < p_box->data.p_elst->i_entry_count; i++ )
@@ -1742,14 +1940,6 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_elst( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_elst->i_segment_duration );
-    FREENULL( p_box->data.p_elst->i_media_time );
-    FREENULL( p_box->data.p_elst->i_media_rate_integer );
-    FREENULL( p_box->data.p_elst->i_media_rate_fraction );
-}
-
 static int MP4_ReadBox_cprt( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i_language;
@@ -1807,10 +1997,7 @@ static int MP4_ReadBox_cmvd( stream_t *p_stream, MP4_Box_t *p_box )
     p_box->data.p_cmvd->i_compressed_size = i_read;
 
     if( !( p_box->data.p_cmvd->p_data = malloc( i_read ) ) )
-    {
-        msg_Dbg( p_stream, "read box: \"cmvd\" not enough memory to load data" );
         return( 1 );
-    }
 
     /* now copy compressed data */
     memcpy( p_box->data.p_cmvd->p_data,
@@ -1845,10 +2032,7 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
 #endif
 
     if( !( p_box->data.p_cmov = malloc( sizeof( MP4_Box_data_cmov_t ) ) ) )
-    {
-        msg_Err( p_stream, "out of memory" );
         return 0;
-    }
     memset( p_box->data.p_cmov, 0, sizeof( MP4_Box_data_cmov_t ) );
 
     if( !p_box->p_father ||
@@ -1869,29 +2053,25 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
         p_cmvd->data.p_cmvd->p_data == NULL )
     {
         msg_Warn( p_stream, "read box: \"cmov\" incomplete" );
-        return 1;
+        return 0;
     }
 
     if( p_dcom->data.p_dcom->i_algorithm != FOURCC_zlib )
     {
         msg_Dbg( p_stream, "read box: \"cmov\" compression algorithm : %4.4s "
                  "not supported", (char*)&p_dcom->data.p_dcom->i_algorithm );
-        return 1;
+        return 0;
     }
 
 #ifndef HAVE_ZLIB_H
     msg_Dbg( p_stream, "read box: \"cmov\" zlib unsupported" );
-    return 1;
+    return 0;
 
 #else
     /* decompress data */
     /* allocate a new buffer */
     if( !( p_data = malloc( p_cmvd->data.p_cmvd->i_uncompressed_size ) ) )
-    {
-        msg_Err( p_stream, "read box: \"cmov\" not enough memory to "
-                 "uncompress data" );
-        return 1;
-    }
+        return 0;
     /* init default structures */
     z_data.next_in   = p_cmvd->data.p_cmvd->p_data;
     z_data.avail_in  = p_cmvd->data.p_cmvd->i_compressed_size;
@@ -1906,7 +2086,7 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
     {
         msg_Err( p_stream, "read box: \"cmov\" error while uncompressing" );
         free( p_data );
-        return 1;
+        return 0;
     }
 
     /* uncompress */
@@ -1915,7 +2095,7 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
     {
         msg_Err( p_stream, "read box: \"cmov\" error while uncompressing" );
         free( p_data );
-        return 1;
+        return 0;
     }
 
     if( p_cmvd->data.p_cmvd->i_uncompressed_size != z_data.total_out )
@@ -1936,12 +2116,12 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
     p_cmvd->data.p_cmvd->p_data = p_data;
     p_cmvd->data.p_cmvd->b_compressed = 0;
 
-    msg_Dbg( p_stream, "read box: \"cmov\" box succesfully uncompressed" );
+    msg_Dbg( p_stream, "read box: \"cmov\" box successfully uncompressed" );
 
     /* now create a memory stream */
     p_stream_memory =
         stream_MemoryNew( VLC_OBJECT(p_stream), p_cmvd->data.p_cmvd->p_data,
-                          p_cmvd->data.p_cmvd->i_uncompressed_size, VLC_TRUE );
+                          p_cmvd->data.p_cmvd->i_uncompressed_size, true );
 
     /* and read uncompressd moov */
     p_box->data.p_cmov->p_moov = MP4_ReadBox( p_stream_memory, NULL );
@@ -1964,10 +2144,16 @@ static int MP4_ReadBox_rdrf( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_rdrf );
     MP4_GETFOURCC( p_box->data.p_rdrf->i_ref_type );
     MP4_GET4BYTES( i_len );
+    i_len++;
+
     if( i_len > 0 )
     {
         uint32_t i;
-        p_box->data.p_rdrf->psz_ref = malloc( i_len  + 1);
+        p_box->data.p_rdrf->psz_ref = malloc( i_len );
+        if( p_box->data.p_rdrf->psz_ref == NULL )
+            MP4_READBOX_EXIT( 0 );
+        i_len--;
+
         for( i = 0; i < i_len; i++ )
         {
             MP4_GET1BYTE( p_box->data.p_rdrf->psz_ref[i] );
@@ -2045,21 +2231,59 @@ static int MP4_ReadBox_rmvc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
+static int MP4_ReadBox_frma( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_READBOX_ENTER( MP4_Box_data_frma_t );
+
+    MP4_GETFOURCC( p_box->data.p_frma->i_type );
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"frma\" i_type:%4.4s",
+             (char *)&p_box->data.p_frma->i_type );
+#endif
+
+    MP4_READBOX_EXIT( 1 );
+}
+
+static int MP4_ReadBox_skcr( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_READBOX_ENTER( MP4_Box_data_frma_t );
+
+    MP4_GET4BYTES( p_box->data.p_skcr->i_init );
+    MP4_GET4BYTES( p_box->data.p_skcr->i_encr );
+    MP4_GET4BYTES( p_box->data.p_skcr->i_decr );
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"skcr\" i_init:%d i_encr:%d i_decr:%d",
+             p_box->data.p_skcr->i_init,
+             p_box->data.p_skcr->i_encr,
+             p_box->data.p_skcr->i_decr );
+#endif
+
+    MP4_READBOX_EXIT( 1 );
+}
+
 static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_Box_t *p_drms_box = p_box;
+    void *p_drms = NULL;
 
     MP4_READBOX_ENTER( uint8_t );
 
     do
     {
         p_drms_box = p_drms_box->p_father;
-    } while( p_drms_box && p_drms_box->i_type != FOURCC_drms );
+    } while( p_drms_box && p_drms_box->i_type != FOURCC_drms
+                        && p_drms_box->i_type != FOURCC_drmi );
+
+    if( p_drms_box && p_drms_box->i_type == FOURCC_drms )
+        p_drms = p_drms_box->data.p_sample_soun->p_drms;
+    else if( p_drms_box && p_drms_box->i_type == FOURCC_drmi )
+        p_drms = p_drms_box->data.p_sample_vide->p_drms;
 
-    if( p_drms_box && p_drms_box->data.p_sample_soun->p_drms )
+    if( p_drms_box && p_drms )
     {
-        int i_ret = drms_init( p_drms_box->data.p_sample_soun->p_drms,
-                               p_box->i_type, p_peek, i_read );
+        int i_ret = drms_init( p_drms, p_box->i_type, p_peek, i_read );
         if( i_ret )
         {
             const char *psz_error;
@@ -2081,8 +2305,12 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
                 msg_Err( p_stream, "drms_init(c%3.3s) failed (%s)",
                         (char *)&p_box->i_type+1, psz_error );
 
-            drms_free( p_drms_box->data.p_sample_soun->p_drms );
-            p_drms_box->data.p_sample_soun->p_drms = NULL;
+            drms_free( p_drms );
+
+            if( p_drms_box->i_type == FOURCC_drms )
+                p_drms_box->data.p_sample_soun->p_drms = NULL;
+            else if( p_drms_box->i_type == FOURCC_drmi )
+                p_drms_box->data.p_sample_vide->p_drms = NULL;
         }
     }
 
@@ -2091,21 +2319,26 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_0xa9xxx( stream_t *p_stream, MP4_Box_t *p_box )
 {
-    uint16_t i_length, i_dummy;
+    uint16_t i16;
 
     MP4_READBOX_ENTER( MP4_Box_data_0xa9xxx_t );
 
     p_box->data.p_0xa9xxx->psz_text = NULL;
 
-    MP4_GET2BYTES( i_length );
+    MP4_GET2BYTES( i16 );
 
-    if( i_length > 0 )
+    if( i16 > 0 )
     {
-        MP4_GET2BYTES( i_dummy );
-        if( i_length > i_read ) i_length = i_read;
+        int i_length = i16;
+
+        MP4_GET2BYTES( i16 );
+        if( i_length >= i_read ) i_length = i_read + 1;
 
-        p_box->data.p_0xa9xxx->psz_text = malloc( i_length + 1 );
+        p_box->data.p_0xa9xxx->psz_text = malloc( i_length );
+        if( p_box->data.p_0xa9xxx->psz_text == NULL )
+            MP4_READBOX_EXIT( 0 );
 
+        i_length--;
         memcpy( p_box->data.p_0xa9xxx->psz_text,
                 p_peek, i_length );
         p_box->data.p_0xa9xxx->psz_text[i_length] = '\0';
@@ -2136,11 +2369,13 @@ static int MP4_ReadBox_0xa9xxx( stream_t *p_stream, MP4_Box_t *p_box )
             MP4_GET4BYTES( i_version );
             MP4_GET4BYTES( i_reserved );
             // version should be 0, flags should be 1 for text, 0 for data
-            if( i_version == 0x00000001 )
+            if( ( i_version == 0x00000001 ) && (i_data_len >= 12 ) )
             {
                 // the rest is the text
                 i_data_len -= 12;
                 p_box->data.p_0xa9xxx->psz_text = malloc( i_data_len + 1 );
+                if( p_box->data.p_0xa9xxx->psz_text == NULL )
+                    MP4_READBOX_EXIT( 0 );
 
                 memcpy( p_box->data.p_0xa9xxx->psz_text,
                         p_peek, i_data_len );
@@ -2167,6 +2402,14 @@ static void MP4_FreeBox_0xa9xxx( MP4_Box_t *p_box )
 }
 
 /* Chapter support */
+static void MP4_FreeBox_chpl( MP4_Box_t *p_box )
+{
+    MP4_Box_data_chpl_t *p_chpl = p_box->data.p_chpl;
+    int i;
+    for( i = 0; i < p_chpl->i_chapter; i++ )
+        free( p_chpl->chapter[i].psz_name );
+}
+
 static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_Box_data_chpl_t *p_chpl;
@@ -2191,6 +2434,9 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
         MP4_GET1BYTE( i_len );
 
         p_chpl->chapter[i].psz_name = malloc( i_len + 1 );
+        if( !p_chpl->chapter[i].psz_name )
+            goto error;
+
         i_copy = __MIN( i_len, i_read );
         if( i_copy > 0 )
             memcpy( p_chpl->chapter[i].psz_name, p_peek, i_copy );
@@ -2227,13 +2473,9 @@ static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
                        p_chpl->i_chapter );
 #endif
     MP4_READBOX_EXIT( 1 );
-}
-static void MP4_FreeBox_chpl( MP4_Box_t *p_box )
-{
-    MP4_Box_data_chpl_t *p_chpl = p_box->data.p_chpl;
-    int i;
-    for( i = 0; i < p_chpl->i_chapter; i++ )
-        free( p_chpl->chapter[i].psz_name );
+
+error:
+    MP4_READBOX_EXIT( 0 );
 }
 
 static int MP4_ReadBox_tref_generic( stream_t *p_stream, MP4_Box_t *p_box )
@@ -2244,7 +2486,9 @@ static int MP4_ReadBox_tref_generic( stream_t *p_stream, MP4_Box_t *p_box )
     p_box->data.p_tref_generic->i_track_ID = NULL;
     p_box->data.p_tref_generic->i_entry_count = i_read / sizeof(uint32_t);
     if( p_box->data.p_tref_generic->i_entry_count > 0 )
-        p_box->data.p_tref_generic->i_track_ID = malloc( p_box->data.p_tref_generic->i_entry_count * sizeof(uint32_t) );
+        p_box->data.p_tref_generic->i_track_ID = calloc( p_box->data.p_tref_generic->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_tref_generic->i_track_ID == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     for( i = 0; i < p_box->data.p_tref_generic->i_entry_count; i++ )
     {
@@ -2307,6 +2551,7 @@ static int MP4_ReadBox_default( stream_t *p_stream, MP4_Box_t *p_box )
             case FOURCC_text:
                 return MP4_ReadBox_sample_text( p_stream, p_box );
             case FOURCC_tx3g:
+            case FOURCC_sbtl:
                 return MP4_ReadBox_sample_tx3g( p_stream, p_box );
             default:
                 msg_Warn( p_stream,
@@ -2388,6 +2633,10 @@ static const struct
     { FOURCC_dcom,  MP4_ReadBox_dcom,       MP4_FreeBox_Common },
     { FOURCC_cmvd,  MP4_ReadBox_cmvd,       MP4_FreeBox_cmvd },
     { FOURCC_avcC,  MP4_ReadBox_avcC,       MP4_FreeBox_avcC },
+    { FOURCC_dac3,  MP4_ReadBox_dac3,       MP4_FreeBox_Common },
+    { FOURCC_enda,  MP4_ReadBox_enda,       MP4_FreeBox_Common },
+    { FOURCC_gnre,  MP4_ReadBox_gnre,       MP4_FreeBox_Common },
+    { FOURCC_trkn,  MP4_ReadBox_trkn,       MP4_FreeBox_Common },
 
     /* Nothing to do with this box */
     { FOURCC_mdat,  MP4_ReadBoxSkip,        MP4_FreeBox_Common },
@@ -2420,6 +2669,7 @@ static const struct
     { FOURCC_OggS,  MP4_ReadBox_sample_soun,    MP4_FreeBox_sample_soun },
     { FOURCC_alac,  MP4_ReadBox_sample_soun,    MP4_FreeBox_sample_soun },
 
+    { FOURCC_drmi,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_vide,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_mp4v,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_SVQ1,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
@@ -2449,6 +2699,8 @@ static const struct
 
     { FOURCC_dvc,   MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_dvp,   MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+    { FOURCC_dv5n,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+    { FOURCC_dv5p,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_VP31,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_vp31,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_h264,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
@@ -2487,6 +2739,8 @@ static const struct
     { FOURCC_iviv,  MP4_ReadBox_drms,           MP4_FreeBox_Common },
     { FOURCC_name,  MP4_ReadBox_drms,           MP4_FreeBox_Common },
     { FOURCC_priv,  MP4_ReadBox_drms,           MP4_FreeBox_Common },
+    { FOURCC_frma,  MP4_ReadBox_frma,           MP4_FreeBox_Common },
+    { FOURCC_skcr,  MP4_ReadBox_skcr,           MP4_FreeBox_Common },
 
     /* found in udta */
     { FOURCC_0xa9nam,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
@@ -2514,6 +2768,14 @@ static const struct
     { FOURCC_0xa9url,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
     { FOURCC_0xa9ope,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
     { FOURCC_0xa9com,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9wrt,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9too,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9wrn,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9mak,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9mod,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9PRD,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9grp,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
+    { FOURCC_0xa9lyr,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
 
     { FOURCC_chpl,   MP4_ReadBox_chpl,          MP4_FreeBox_chpl },
 
@@ -2532,9 +2794,12 @@ static const struct
  *****************************************************************************/
 static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
 {
-    MP4_Box_t    *p_box = malloc( sizeof( MP4_Box_t ) );
+    MP4_Box_t    *p_box = calloc( 1, sizeof( MP4_Box_t ) ); /* Needed to ensure simple on error handler */
     unsigned int i_index;
 
+    if( p_box == NULL )
+        return NULL;
+
     if( !MP4_ReadBoxCommon( p_stream, p_box ) )
     {
         msg_Warn( p_stream, "cannot read one box" );
@@ -2561,7 +2826,7 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
 
     if( !(MP4_Box_Function[i_index].MP4_ReadBox_function)( p_stream, p_box ) )
     {
-        free( p_box );
+        MP4_BoxFree( p_stream, p_box );
         return NULL;
     }
 
@@ -2578,9 +2843,7 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
     MP4_Box_t    *p_child;
 
     if( !p_box )
-    {
         return; /* hehe */
-    }
 
     for( p_child = p_box->p_first; p_child != NULL; )
     {
@@ -2618,10 +2881,8 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
         {
             MP4_Box_Function[i_index].MP4_FreeBox_function( p_box );
         }
-
         free( p_box->data.p_data );
     }
-
     free( p_box );
 }
 
@@ -2638,6 +2899,9 @@ MP4_Box_t *MP4_BoxGetRoot( stream_t *s )
     int i_result;
 
     p_root = malloc( sizeof( MP4_Box_t ) );
+    if( p_root == NULL )
+        return NULL;
+
     p_root->i_pos = 0;
     p_root->i_type = VLC_FOURCC( 'r', 'o', 'o', 't' );
     p_root->i_shortsize = 1;
@@ -2656,7 +2920,6 @@ MP4_Box_t *MP4_BoxGetRoot( stream_t *s )
 
     if( i_result )
     {
-        MP4_Box_t *p_child;
         MP4_Box_t *p_moov;
         MP4_Box_t *p_cmov;
 
@@ -2678,7 +2941,7 @@ MP4_Box_t *MP4_BoxGetRoot( stream_t *s )
             p_moov->p_father = p_root;
 
             /* insert this new moov box as first child of p_root */
-            p_moov->p_next = p_child = p_root->p_first;
+            p_moov->p_next = p_root->p_first;
             p_root->p_first = p_moov;
         }
     }
@@ -2703,18 +2966,24 @@ static void __MP4_BoxDumpStructure( stream_t *s,
     }
     else
     {
-        char str[512];
         unsigned int i;
-        memset( str, (uint8_t)' ', 512 );
+
+        char str[512];
+        if( i_level >= (sizeof(str) - 1)/5 )
+            return;
+
+        memset( str, ' ', sizeof(str) );
         for( i = 0; i < i_level; i++ )
         {
             str[i*5] = '|';
         }
-        if MP4_BOX_TYPE_ASCII()
-            sprintf( str + i_level * 5, "+ %4.4s size %d",
+        if( MP4_BOX_TYPE_ASCII() )
+            snprintf( &str[i_level * 5], sizeof(str) - 5*i_level,
+                      "+ %4.4s size %d",
                         (char*)&p_box->i_type, (uint32_t)p_box->i_size );
         else
-            sprintf( str + i_level * 5, "+ c%3.3s size %d",
+            snprintf( &str[i_level * 5], sizeof(str) - 5*i_level,
+                      "+ c%3.3s size %d",
                         (char*)&p_box->i_type+1, (uint32_t)p_box->i_size );
         msg_Dbg( s, "%s", str );
     }
@@ -2794,7 +3063,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
                           MP4_Box_t *p_box, const char *psz_fmt, va_list args)
 {
     char *psz_dup;
-    char    *psz_path;
+    char *psz_path;
 
     if( !p_box )
     {
@@ -2807,7 +3076,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
 
     if( !psz_path || !psz_path[0] )
     {
-        FREENULL( psz_path );
+        free( psz_path );
         *pp_result = NULL;
         return;
     }
@@ -2824,7 +3093,6 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
 //                 psz_path,psz_token,i_number );
         if( !psz_token )
         {
-            FREENULL( psz_token );
             free( psz_dup );
             *pp_result = p_box;
             return;
@@ -2890,7 +3158,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
             }
         }
         else
-        if( strlen( psz_token ) == 0 )
+        if( *psz_token == '\0' )
         {
             p_box = p_box->p_first;
             for( ; ; )