X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=modules%2Fdemux%2Fmp4%2Flibmp4.c;h=d66e173b4780e7dcfc1a7007f8ec601920b74d04;hb=97897eeeb22b1238e56632b16cda1a0375ae7708;hp=4bb335f1fda2b2a70ab8f25cf912d01576d6c39b;hpb=318e9b862b1792bee23521a459ca44ef1e40f7ed;p=vlc

diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 4bb335f1fd..d66e173b47 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -20,12 +20,14 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  *****************************************************************************/
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
 #include <vlc/vlc.h>
 
-#include <stdio.h>
-#include <stdlib.h>                                      /* malloc(), free() */
 
-#include <vlc/input.h>
+#include <vlc_demux.h>
 
 #ifdef HAVE_ZLIB_H
 #   include <zlib.h>                                  /* for compressed moov */
@@ -39,50 +41,48 @@
  *  *look* at the code.
  *
  *****************************************************************************/
-#define MP4_BOX_HEADERSIZE( p_box ) \
-  ( 8 + ( p_box->i_shortsize == 1 ? 8 : 0 ) \
+#define MP4_BOX_HEADERSIZE( p_box )             \
+  ( 8 + ( p_box->i_shortsize == 1 ? 8 : 0 )     \
       + ( p_box->i_type == FOURCC_uuid ? 16 : 0 ) )
 
-#define MP4_GET1BYTE( dst ) \
-    dst = *p_peek; p_peek++; i_read--
-
-#define MP4_GET2BYTES( dst ) \
-    dst = GetWBE( p_peek ); p_peek += 2; i_read -= 2
-
-#define MP4_GET3BYTES( dst ) \
-    dst = Get24bBE( p_peek ); p_peek += 3; i_read -= 3
+#define MP4_GETX_PRIVATE(dst, code, size) do { \
+    if( (i_read) >= (size) ) { dst = (code); p_peek += (size); } \
+    else { dst = 0; }   \
+    i_read -= (size);   \
+  } while(0)
 
-#define MP4_GET4BYTES( dst ) \
-    dst = GetDWBE( p_peek ); p_peek += 4; i_read -= 4
-
-#define MP4_GETFOURCC( dst ) \
-    dst = VLC_FOURCC( p_peek[0], p_peek[1], p_peek[2], p_peek[3] ); \
-    p_peek += 4; i_read -= 4
-
-#define MP4_GET8BYTES( dst ) \
-    dst = GetQWBE( p_peek ); p_peek += 8; i_read -= 8
+#define MP4_GET1BYTE( dst )  MP4_GETX_PRIVATE( dst, *p_peek, 1 )
+#define MP4_GET2BYTES( dst ) MP4_GETX_PRIVATE( dst, GetWBE(p_peek), 2 )
+#define MP4_GET3BYTES( dst ) MP4_GETX_PRIVATE( dst, Get24bBE(p_peek), 3 )
+#define MP4_GET4BYTES( dst ) MP4_GETX_PRIVATE( dst, GetDWBE(p_peek), 4 )
+#define MP4_GET8BYTES( dst ) MP4_GETX_PRIVATE( dst, GetQWBE(p_peek), 8 )
+#define MP4_GETFOURCC( dst ) MP4_GETX_PRIVATE( dst, \
+                VLC_FOURCC(p_peek[0],p_peek[1],p_peek[2],p_peek[3]), 4)
 
 #define MP4_GETVERSIONFLAGS( p_void ) \
     MP4_GET1BYTE( p_void->i_version ); \
     MP4_GET3BYTES( p_void->i_flags )
 
-#define MP4_GETSTRINGZ( p_str ) \
-    if( ( i_read > 0 )&&(p_peek[0] ) ) \
-    { \
-        p_str = calloc( sizeof( char ), __MIN( strlen( (char*)p_peek ), i_read )+1);\
-        memcpy( p_str, p_peek, __MIN( strlen( (char*)p_peek ), i_read ) ); \
-        p_str[__MIN( strlen( (char*)p_peek ), i_read )] = 0; \
-        p_peek += strlen( p_str ) + 1; \
-        i_read -= strlen( p_str ) + 1; \
-    } \
-    else \
-    { \
+#define MP4_GETSTRINGZ( p_str )         \
+    if( (i_read > 0) && (p_peek[0]) )   \
+    {       \
+        const int __i_copy__ = strnlen( (char*)p_peek, i_read-1 );  \
+        p_str = malloc( __i_copy__+1 );               \
+        if( p_str ) \
+        { \
+             memcpy( p_str, p_peek, __i_copy__ ); \
+             p_str[__i_copy__] = 0; \
+        } \
+        p_peek += __i_copy__ + 1;   \
+        i_read -= __i_copy__ + 1;   \
+    }       \
+    else    \
+    {       \
         p_str = NULL; \
     }
 
-
 #define MP4_READBOX_ENTER( MP4_Box_data_TYPE_t ) \
-    uint64_t  i_read = p_box->i_size; \
+    int64_t  i_read = p_box->i_size; \
     uint8_t *p_peek, *p_buff; \
     int i_actually_read; \
     if( !( p_peek = p_buff = malloc( i_read ) ) ) \
@@ -90,7 +90,7 @@
         return( 0 ); \
     } \
     i_actually_read = stream_Read( p_stream, p_peek, i_read ); \
-    if( i_actually_read < 0 || (uint64_t)i_actually_read < i_read )\
+    if( i_actually_read < 0 || (int64_t)i_actually_read < i_read )\
     { \
         free( p_buff ); \
         return( 0 ); \
@@ -104,12 +104,13 @@
     }
 
 #define MP4_READBOX_EXIT( i_code ) \
-    free( p_buff ); \
-    if( i_read < 0 ) \
+    do \
     { \
-        msg_Warn( p_stream, "Not enough data" ); \
-    } \
-    return( i_code )
+        free( p_buff ); \
+        if( i_read < 0 ) \
+            msg_Warn( p_stream, "Not enough data" ); \
+        return( i_code ); \
+    } while (0)
 
 
 /* Some assumptions:
@@ -117,12 +118,19 @@
 
 */
 
-static uint32_t Get24bBE( uint8_t *p )
+/* This macro is used when we want to printf the box type
+ * APPLE annotation box is :
+ *  either 0xA9 + 24-bit ASCII text string (and 0xA9 isn't printable)
+ *  either 32-bit ASCII text string
+ */
+#define MP4_BOX_TYPE_ASCII() ( ((char*)&p_box->i_type)[0] != (char)0xA9 )
+
+static uint32_t Get24bBE( const uint8_t *p )
 {
     return( ( p[0] <<16 ) + ( p[1] <<8 ) + p[2] );
 }
 
-static void GetUUID( UUID_t *p_uuid, uint8_t *p_buff )
+static void GetUUID( UUID_t *p_uuid, const uint8_t *p_buff )
 {
     memcpy( p_uuid, p_buff, 16 );
 }
@@ -132,6 +140,8 @@ static void CreateUUID( UUID_t *p_uuid, uint32_t i_fourcc )
     /* made by 0xXXXXXXXX-0011-0010-8000-00aa00389b71
             where XXXXXXXX is the fourcc */
     /* FIXME implement this */
+    (void)p_uuid;
+    (void)i_fourcc;
 }
 
 /* some functions for mp4 encoding of variables */
@@ -170,7 +180,7 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father );
 int MP4_ReadBoxCommon( stream_t *p_stream, MP4_Box_t *p_box )
 {
     int      i_read;
-    uint8_t  *p_peek;
+    const uint8_t  *p_peek;
 
     if( ( ( i_read = stream_Peek( p_stream, &p_peek, 32 ) ) < 8 ) )
     {
@@ -213,8 +223,12 @@ int MP4_ReadBoxCommon( stream_t *p_stream, MP4_Box_t *p_box )
 #ifdef MP4_VERBOSE
     if( p_box->i_size )
     {
-        msg_Dbg( p_stream, "found Box: %4.4s size "I64Fd,
-                 (char*)&p_box->i_type, p_box->i_size );
+        if MP4_BOX_TYPE_ASCII()
+            msg_Dbg( p_stream, "found Box: %4.4s size %"PRId64,
+                    (char*)&p_box->i_type, p_box->i_size );
+        else
+            msg_Dbg( p_stream, "found Box: c%3.3s size %"PRId64,
+                    (char*)&p_box->i_type+1, p_box->i_size );
     }
 #endif
 
@@ -243,11 +257,14 @@ static int MP4_NextBox( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_box->p_father )
     {
+        const int i_box_end = p_box->i_size + p_box->i_pos;
+        const int i_father_end = p_box->p_father->i_size + p_box->p_father->i_pos;
+
         /* check if it's within p-father */
-        if( p_box->i_size + p_box->i_pos >=
-            p_box->p_father->i_size + p_box->p_father->i_pos )
+        if( i_box_end >= i_father_end )
         {
-            msg_Dbg( p_stream, "out of bound child" );
+            if( i_box_end > i_father_end )
+                msg_Dbg( p_stream, "out of bound child" );
             return 0; /* out of bound */
         }
     }
@@ -308,6 +325,7 @@ static int MP4_ReadBoxContainer( stream_t *p_stream, MP4_Box_t *p_container )
 static void MP4_FreeBox_Common( MP4_Box_t *p_box )
 {
     /* Up to now do nothing */
+    (void)p_box;
 }
 
 static int MP4_ReadBoxSkip( stream_t *p_stream, MP4_Box_t *p_box )
@@ -317,7 +335,7 @@ static int MP4_ReadBoxSkip( stream_t *p_stream, MP4_Box_t *p_box )
         p_box->p_father->i_type == VLC_FOURCC( 'r', 'o', 'o', 't' ) &&
         p_box->i_type == FOURCC_free )
     {
-        uint8_t *p_peek;
+        const uint8_t *p_peek;
         int     i_read;
         vlc_fourcc_t i_fcc;
 
@@ -342,7 +360,10 @@ static int MP4_ReadBoxSkip( stream_t *p_stream, MP4_Box_t *p_box )
 
     /* Nothing to do */
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "skip box: \"%4.4s\"", (char*)&p_box->i_type );
+    if MP4_BOX_TYPE_ASCII()
+        msg_Dbg( p_stream, "skip box: \"%4.4s\"", (char*)&p_box->i_type );
+    else
+        msg_Dbg( p_stream, "skip box: \"c%3.3s\"", (char*)&p_box->i_type+1 );
 #endif
     return 1;
 }
@@ -357,12 +378,16 @@ static int MP4_ReadBox_ftyp( stream_t *p_stream, MP4_Box_t *p_box )
     if( ( p_box->data.p_ftyp->i_compatible_brands_count = i_read / 4 ) )
     {
         unsigned int i;
-        p_box->data.p_ftyp->i_compatible_brands =
-            calloc( p_box->data.p_ftyp->i_compatible_brands_count, sizeof(uint32_t));
+        uint32_t *tab = p_box->data.p_ftyp->i_compatible_brands =
+            calloc( p_box->data.p_ftyp->i_compatible_brands_count,
+                    sizeof(uint32_t));
+
+        if( tab == NULL )
+            MP4_READBOX_EXIT( 0 );
 
         for( i =0; i < p_box->data.p_ftyp->i_compatible_brands_count; i++ )
         {
-            MP4_GETFOURCC( p_box->data.p_ftyp->i_compatible_brands[i] );
+            MP4_GETFOURCC( tab[i] );
         }
     }
     else
@@ -586,7 +611,9 @@ static int MP4_ReadBox_hdlr( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( i_read > 0 )
     {
-        p_box->data.p_hdlr->psz_name = calloc( sizeof( char ), i_read + 1 );
+        uint8_t *psz = p_box->data.p_hdlr->psz_name = malloc( i_read + 1 );
+        if( psz == NULL )
+            MP4_READBOX_EXIT( 0 );
 
         /* Yes, I love .mp4 :( */
         if( p_box->data.p_hdlr->i_predefined == VLC_FOURCC( 'm', 'h', 'l', 'r' ) )
@@ -597,20 +624,20 @@ static int MP4_ReadBox_hdlr( stream_t *p_stream, MP4_Box_t *p_box )
             MP4_GET1BYTE( i_len );
             i_copy = __MIN( i_read, i_len );
 
-            memcpy( p_box->data.p_hdlr->psz_name, p_peek, i_copy );
+            memcpy( psz, p_peek, i_copy );
             p_box->data.p_hdlr->psz_name[i_copy] = '\0';
         }
         else
         {
-            memcpy( p_box->data.p_hdlr->psz_name, p_peek, i_read );
+            memcpy( psz, p_peek, i_read );
             p_box->data.p_hdlr->psz_name[i_read] = '\0';
         }
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"hdlr\" handler type %4.4s name %s",
-                       (char*)&p_box->data.p_hdlr->i_handler_type,
-                       p_box->data.p_hdlr->psz_name );
+        msg_Dbg( p_stream, "read box: \"hdlr\" handler type %4.4s name %s",
+                   (char*)&p_box->data.p_hdlr->i_handler_type,
+                   p_box->data.p_hdlr->psz_name );
 
 #endif
     MP4_READBOX_EXIT( 1 );
@@ -707,7 +734,7 @@ static int MP4_ReadBox_url( stream_t *p_stream, MP4_Box_t *p_box )
 
 static void MP4_FreeBox_url( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_url->psz_location )
+    FREENULL( p_box->data.p_url->psz_location );
 }
 
 static int MP4_ReadBox_urn( stream_t *p_stream, MP4_Box_t *p_box )
@@ -752,6 +779,11 @@ static int MP4_ReadBox_dref( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
+static void MP4_FreeBox_stts( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stts->i_sample_count );
+    FREENULL( p_box->data.p_stts->i_sample_delta );
+}
 
 static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -762,9 +794,15 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stts->i_entry_count );
 
     p_box->data.p_stts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stts->i_sample_delta =
-        calloc( sizeof( uint32_t ), p_box->data.p_stts->i_entry_count );
+        calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stts->i_sample_count == NULL
+     || p_box->data.p_stts->i_sample_delta == NULL )
+    {
+        MP4_FreeBox_stts( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -780,10 +818,11 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stts( MP4_Box_t *p_box )
+
+static void MP4_FreeBox_ctts( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_stts->i_sample_count );
-    FREENULL( p_box->data.p_stts->i_sample_delta );
+    FREENULL( p_box->data.p_ctts->i_sample_count );
+    FREENULL( p_box->data.p_ctts->i_sample_offset );
 }
 
 static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
@@ -796,9 +835,15 @@ static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_ctts->i_entry_count );
 
     p_box->data.p_ctts->i_sample_count =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_ctts->i_sample_offset =
-        calloc( sizeof( uint32_t ), p_box->data.p_ctts->i_entry_count );
+        calloc( p_box->data.p_ctts->i_entry_count, sizeof(uint32_t) );
+    if( ( p_box->data.p_ctts->i_sample_count == NULL )
+     || ( p_box->data.p_ctts->i_sample_offset == NULL ) )
+    {
+        MP4_FreeBox_ctts( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_ctts->i_entry_count )&&( i_read >=8 ); i++ )
     {
@@ -814,13 +859,8 @@ static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_ctts( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_ctts->i_sample_count );
-    FREENULL( p_box->data.p_ctts->i_sample_offset );
-}
 
-static int MP4_ReadLengthDescriptor( uint8_t **pp_peek, uint64_t  *i_read )
+static int MP4_ReadLengthDescriptor( uint8_t **pp_peek, int64_t  *i_read )
 {
     unsigned int i_b;
     unsigned int i_len = 0;
@@ -835,12 +875,24 @@ static int MP4_ReadLengthDescriptor( uint8_t **pp_peek, uint64_t  *i_read )
     return( i_len );
 }
 
+
+static void MP4_FreeBox_esds( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_esds->es_descriptor.psz_URL );
+    if( p_box->data.p_esds->es_descriptor.p_decConfigDescr )
+    {
+        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr->p_decoder_specific_info );
+        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr );
+    }
+}
+
 static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 {
 #define es_descriptor p_box->data.p_esds->es_descriptor
     unsigned int i_len;
     unsigned int i_flags;
     unsigned int i_type;
+    unsigned int code = 0;
 
     MP4_READBOX_ENTER( MP4_Box_data_esds_t );
 
@@ -873,9 +925,12 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
             unsigned int i_len;
 
             MP4_GET1BYTE( i_len );
-            es_descriptor.psz_URL = calloc( sizeof(char), i_len + 1 );
-            memcpy( es_descriptor.psz_URL, p_peek, i_len );
-            es_descriptor.psz_URL[i_len] = 0;
+            es_descriptor.psz_URL = malloc( i_len + 1 );
+            if( es_descriptor.psz_URL )
+            {
+                memcpy( es_descriptor.psz_URL, p_peek, i_len );
+                es_descriptor.psz_URL[i_len] = 0;
+            }
             p_peek += i_len;
             i_read -= i_len;
         }
@@ -905,6 +960,11 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 
     es_descriptor.p_decConfigDescr =
             malloc( sizeof( MP4_descriptor_decoder_config_t ));
+    if( es_descriptor.p_decConfigDescr == NULL )
+    {
+        free( es_descriptor.psz_URL );
+        goto error;
+    }
 
     MP4_GET1BYTE( es_descriptor.p_decConfigDescr->i_objectTypeIndication );
     MP4_GET1BYTE( i_flags );
@@ -930,23 +990,21 @@ static int MP4_ReadBox_esds( stream_t *p_stream, MP4_Box_t *p_box )
 
     es_descriptor.p_decConfigDescr->i_decoder_specific_info_len = i_len;
     es_descriptor.p_decConfigDescr->p_decoder_specific_info = malloc( i_len );
+    if( es_descriptor.p_decConfigDescr->p_decoder_specific_info == NULL )
+    {
+        MP4_FreeBox_esds( p_box );
+        goto error;
+    }
     memcpy( es_descriptor.p_decConfigDescr->p_decoder_specific_info,
             p_peek, i_len );
+    code = 1;
 
-    MP4_READBOX_EXIT( 1 );
+error:
+    MP4_READBOX_EXIT( code );
 
 #undef es_descriptor
 }
 
-static void MP4_FreeBox_esds( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_esds->es_descriptor.psz_URL );
-    if( p_box->data.p_esds->es_descriptor.p_decConfigDescr )
-    {
-        FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr->p_decoder_specific_info );
-    }
-    FREENULL( p_box->data.p_esds->es_descriptor.p_decConfigDescr );
-}
 
 static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -959,8 +1017,9 @@ static int MP4_ReadBox_avcC( stream_t *p_stream, MP4_Box_t *p_box )
     p_avcC->i_avcC = i_read;
     if( p_avcC->i_avcC > 0 )
     {
-        p_avcC->p_avcC = malloc( p_avcC->i_avcC );
-        memcpy( p_avcC->p_avcC, p_peek, i_read );
+        uint8_t * p = p_avcC->p_avcC = malloc( p_avcC->i_avcC );
+        if( p )
+            memcpy( p, p_peek, i_read );
     }
 
     MP4_GET1BYTE( p_avcC->i_version );
@@ -1076,8 +1135,10 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
      */
     if( i_read > 0 )
     {
-        p_box->data.p_sample_soun->i_qt_description = i_read;
         p_box->data.p_sample_soun->p_qt_description = malloc( i_read );
+        if( p_box->data.p_sample_soun->p_qt_description == NULL )
+            MP4_READBOX_EXIT( 0 );
+        p_box->data.p_sample_soun->i_qt_description = i_read;
         memcpy( p_box->data.p_sample_soun->p_qt_description, p_peek, i_read );
     }
     else
@@ -1121,12 +1182,12 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
     {
         /* SoundDescriptionV2 */
         double f_sample_rate;
-	int64_t dummy;
+    int64_t dummy;
         uint32_t i_channel;
 
         MP4_GET4BYTES( p_box->data.p_sample_soun->i_sample_per_packet );
         MP4_GET8BYTES( dummy );
-	memcpy( &f_sample_rate, &dummy, 8 );
+    memcpy( &f_sample_rate, &dummy, 8 );
 
         msg_Dbg( p_stream, "read box: %f Hz", f_sample_rate );
         p_box->data.p_sample_soun->i_sampleratehi = (int)f_sample_rate % 65536;
@@ -1148,7 +1209,7 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
         p_box->data.p_sample_soun->i_bytes_per_frame = 0;
         p_box->data.p_sample_soun->i_bytes_per_sample = 0;
 
-        msg_Dbg( p_stream, "read box: \"soun\" mp4 or qt1/2 (rest="I64Fd")",
+        msg_Dbg( p_stream, "read box: \"soun\" mp4 or qt1/2 (rest=%"PRId64")",
                  i_read );
         stream_Seek( p_stream, p_box->i_pos +
                         MP4_BOX_HEADERSIZE( p_box ) + 28 );
@@ -1173,10 +1234,11 @@ static int MP4_ReadBox_sample_soun( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_box->i_type == FOURCC_alac )
     {
-        if( p_box->data.p_sample_soun->p_qt_description )
-            free( p_box->data.p_sample_soun->p_qt_description );
+        free( p_box->data.p_sample_soun->p_qt_description );
 
         p_box->data.p_sample_soun->p_qt_description = malloc( i_read );
+        if( p_box->data.p_sample_soun->p_qt_description == NULL )
+            MP4_READBOX_EXIT( 0 );
         p_box->data.p_sample_soun->i_qt_description = i_read;
         memcpy( p_box->data.p_sample_soun->p_qt_description, p_peek, i_read );
     }
@@ -1230,8 +1292,10 @@ int MP4_ReadBox_sample_vide( stream_t *p_stream, MP4_Box_t *p_box )
      */
     if( i_read > 0 )
     {
-        p_box->data.p_sample_vide->i_qt_image_description = i_read;
         p_box->data.p_sample_vide->p_qt_image_description = malloc( i_read );
+        if( p_box->data.p_sample_vide->p_qt_image_description == NULL )
+            MP4_READBOX_EXIT( 0 );
+        p_box->data.p_sample_vide->i_qt_image_description = i_read;
         memcpy( p_box->data.p_sample_vide->p_qt_image_description,
                 p_peek, i_read );
     }
@@ -1416,7 +1480,9 @@ static int MP4_ReadBox_stsz( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsz->i_sample_count );
 
     p_box->data.p_stsz->i_entry_size =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsz->i_sample_count );
+        calloc( p_box->data.p_stsz->i_sample_count, sizeof(uint32_t) );
+    if( p_box->data.p_stsz->i_entry_size == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     if( !p_box->data.p_stsz->i_sample_size )
     {
@@ -1440,6 +1506,13 @@ static void MP4_FreeBox_stsz( MP4_Box_t *p_box )
     FREENULL( p_box->data.p_stsz->i_entry_size );
 }
 
+static void MP4_FreeBox_stsc( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stsc->i_first_chunk );
+    FREENULL( p_box->data.p_stsc->i_samples_per_chunk );
+    FREENULL( p_box->data.p_stsc->i_sample_description_index );
+}
+
 static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1451,11 +1524,18 @@ static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsc->i_entry_count );
 
     p_box->data.p_stsc->i_first_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_samples_per_chunk =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsc->i_sample_description_index =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsc->i_entry_count );
+        calloc( p_box->data.p_stsc->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stsc->i_first_chunk == NULL
+     || p_box->data.p_stsc->i_samples_per_chunk == NULL
+     || p_box->data.p_stsc->i_sample_description_index == NULL )
+    {
+        MP4_FreeBox_stsc( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stsc->i_entry_count )&&( i_read >= 12 );i++ )
     {
@@ -1472,13 +1552,6 @@ static int MP4_ReadBox_stsc( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stsc( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_stsc->i_first_chunk );
-    FREENULL( p_box->data.p_stsc->i_samples_per_chunk );
-    FREENULL( p_box->data.p_stsc->i_sample_description_index );
-}
-
 static int MP4_ReadBox_stco_co64( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
@@ -1490,7 +1563,9 @@ static int MP4_ReadBox_stco_co64( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_co64->i_entry_count );
 
     p_box->data.p_co64->i_chunk_offset =
-        calloc( sizeof( uint64_t ), p_box->data.p_co64->i_entry_count );
+        calloc( p_box->data.p_co64->i_entry_count, sizeof(uint64_t) );
+    if( p_box->data.p_co64->i_chunk_offset == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     for( i = 0; i < p_box->data.p_co64->i_entry_count; i++ )
     {
@@ -1536,7 +1611,9 @@ static int MP4_ReadBox_stss( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stss->i_entry_count );
 
     p_box->data.p_stss->i_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stss->i_entry_count );
+        calloc( p_box->data.p_stss->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_stss->i_sample_number == NULL )
+        MP4_READBOX_EXIT( 0 );
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 4 ); i++ )
     {
@@ -1556,7 +1633,13 @@ static int MP4_ReadBox_stss( stream_t *p_stream, MP4_Box_t *p_box )
 
 static void MP4_FreeBox_stss( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_stss->i_sample_number )
+    FREENULL( p_box->data.p_stss->i_sample_number );
+}
+
+static void MP4_FreeBox_stsh( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_stsh->i_shadowed_sample_number );
+    FREENULL( p_box->data.p_stsh->i_sync_sample_number );
 }
 
 static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
@@ -1571,11 +1654,16 @@ static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_stsh->i_entry_count );
 
     p_box->data.p_stsh->i_shadowed_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
-
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
     p_box->data.p_stsh->i_sync_sample_number =
-        calloc( sizeof( uint32_t ), p_box->data.p_stsh->i_entry_count );
+        calloc( p_box->data.p_stsh->i_entry_count, sizeof(uint32_t) );
 
+    if( p_box->data.p_stsh->i_shadowed_sample_number == NULL
+     || p_box->data.p_stsh->i_sync_sample_number == NULL )
+    {
+        MP4_FreeBox_stsh( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; (i < p_box->data.p_stss->i_entry_count )&&( i_read >= 8 ); i++ )
     {
@@ -1591,12 +1679,6 @@ static int MP4_ReadBox_stsh( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_stsh( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_stsh->i_shadowed_sample_number )
-    FREENULL( p_box->data.p_stsh->i_sync_sample_number )
-}
-
 
 static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -1607,7 +1689,7 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_stdp );
 
     p_box->data.p_stdp->i_priority =
-        calloc( sizeof( uint16_t ), i_read / 2 );
+        calloc( i_read / 2, sizeof(uint16_t) );
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
@@ -1616,7 +1698,7 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
+    msg_Dbg( p_stream, "read box: \"stdp\" entry-count %"PRId64,
                       i_read / 2 );
 
 #endif
@@ -1625,32 +1707,49 @@ static int MP4_ReadBox_stdp( stream_t *p_stream, MP4_Box_t *p_box )
 
 static void MP4_FreeBox_stdp( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_stdp->i_priority )
+    FREENULL( p_box->data.p_stdp->i_priority );
+}
+
+static void MP4_FreeBox_padb( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_padb->i_reserved1 );
+    FREENULL( p_box->data.p_padb->i_pad2 );
+    FREENULL( p_box->data.p_padb->i_reserved2 );
+    FREENULL( p_box->data.p_padb->i_pad1 );
 }
 
 static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
+    uint32_t count;
 
     MP4_READBOX_ENTER( MP4_Box_data_padb_t );
 
     MP4_GETVERSIONFLAGS( p_box->data.p_padb );
 
-
     MP4_GET4BYTES( p_box->data.p_padb->i_sample_count );
+    count = (p_box->data.p_padb->i_sample_count + 1) / 2;
 
-    p_box->data.p_padb->i_reserved1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_reserved2 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-    p_box->data.p_padb->i_pad1 =
-        calloc( sizeof( uint16_t ), ( p_box->data.p_padb->i_sample_count + 1 ) / 2 );
-
+    p_box->data.p_padb->i_reserved1 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_reserved2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad1 = calloc( count, sizeof(uint16_t) );
+    if( p_box->data.p_padb->i_reserved1 == NULL
+     || p_box->data.p_padb->i_pad2 == NULL
+     || p_box->data.p_padb->i_reserved2 == NULL
+     || p_box->data.p_padb->i_pad1 == NULL )
+    {
+        MP4_FreeBox_padb( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
     for( i = 0; i < i_read / 2 ; i++ )
     {
+        if( i >= count )
+        {
+            MP4_FreeBox_padb( p_box );
+            MP4_READBOX_EXIT( 0 );
+        }
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 7 )&0x01;
         p_box->data.p_padb->i_pad2[i] = ( (*p_peek) >> 4 )&0x07;
         p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 3 )&0x01;
@@ -1660,26 +1759,26 @@ static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
+    msg_Dbg( p_stream, "read box: \"stdp\" entry-count %"PRId64,
                       i_read / 2 );
 
 #endif
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_padb( MP4_Box_t *p_box )
+static void MP4_FreeBox_elst( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_padb->i_reserved1 );
-    FREENULL( p_box->data.p_padb->i_pad2 );
-    FREENULL( p_box->data.p_padb->i_reserved2 );
-    FREENULL( p_box->data.p_padb->i_pad1 );
+    FREENULL( p_box->data.p_elst->i_segment_duration );
+    FREENULL( p_box->data.p_elst->i_media_time );
+    FREENULL( p_box->data.p_elst->i_media_rate_integer );
+    FREENULL( p_box->data.p_elst->i_media_rate_fraction );
 }
 
 static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i;
 
-    MP4_READBOX_ENTER( MP4_Box_data_padb_t );
+    MP4_READBOX_ENTER( MP4_Box_data_elst_t );
 
     MP4_GETVERSIONFLAGS( p_box->data.p_elst );
 
@@ -1687,13 +1786,21 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GET4BYTES( p_box->data.p_elst->i_entry_count );
 
     p_box->data.p_elst->i_segment_duration =
-        calloc( sizeof( uint64_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_time =
-        calloc( sizeof( int64_t ),  p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint64_t) );
     p_box->data.p_elst->i_media_rate_integer =
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
-    p_box->data.p_elst->i_media_rate_fraction=
-        calloc( sizeof( uint16_t ), p_box->data.p_elst->i_entry_count );
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
+    p_box->data.p_elst->i_media_rate_fraction =
+        calloc( p_box->data.p_elst->i_entry_count, sizeof(uint16_t) );
+    if( p_box->data.p_elst->i_segment_duration == NULL
+     || p_box->data.p_elst->i_media_time == NULL
+     || p_box->data.p_elst->i_media_rate_integer == NULL
+     || p_box->data.p_elst->i_media_rate_fraction == NULL )
+    {
+        MP4_FreeBox_elst( p_box );
+        MP4_READBOX_EXIT( 0 );
+    }
 
 
     for( i = 0; i < p_box->data.p_elst->i_entry_count; i++ )
@@ -1719,21 +1826,12 @@ static int MP4_ReadBox_elst( stream_t *p_stream, MP4_Box_t *p_box )
     }
 
 #ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"elst\" entry-count "I64Fd,
-                      i_read / 2 );
-
+    msg_Dbg( p_stream, "read box: \"elst\" entry-count %lu",
+             (unsigned long)p_box->data.p_elst->i_entry_count );
 #endif
     MP4_READBOX_EXIT( 1 );
 }
 
-static void MP4_FreeBox_elst( MP4_Box_t *p_box )
-{
-    FREENULL( p_box->data.p_elst->i_segment_duration );
-    FREENULL( p_box->data.p_elst->i_media_time );
-    FREENULL( p_box->data.p_elst->i_media_rate_integer );
-    FREENULL( p_box->data.p_elst->i_media_rate_fraction );
-}
-
 static int MP4_ReadBox_cprt( stream_t *p_stream, MP4_Box_t *p_box )
 {
     unsigned int i_language;
@@ -1925,7 +2023,7 @@ static int MP4_ReadBox_cmov( stream_t *p_stream, MP4_Box_t *p_box )
     /* now create a memory stream */
     p_stream_memory =
         stream_MemoryNew( VLC_OBJECT(p_stream), p_cmvd->data.p_cmvd->p_data,
-                          p_cmvd->data.p_cmvd->i_uncompressed_size, VLC_TRUE );
+                          p_cmvd->data.p_cmvd->i_uncompressed_size, true );
 
     /* and read uncompressd moov */
     p_box->data.p_cmov->p_moov = MP4_ReadBox( p_stream_memory, NULL );
@@ -1948,10 +2046,16 @@ static int MP4_ReadBox_rdrf( stream_t *p_stream, MP4_Box_t *p_box )
     MP4_GETVERSIONFLAGS( p_box->data.p_rdrf );
     MP4_GETFOURCC( p_box->data.p_rdrf->i_ref_type );
     MP4_GET4BYTES( i_len );
+    i_len++;
+
     if( i_len > 0 )
     {
         uint32_t i;
-        p_box->data.p_rdrf->psz_ref = malloc( i_len  + 1);
+        p_box->data.p_rdrf->psz_ref = malloc( i_len );
+        if( p_box->data.p_rdrf->psz_ref == NULL )
+            MP4_READBOX_EXIT( 0 );
+        i_len--;
+
         for( i = 0; i < i_len; i++ )
         {
             MP4_GET1BYTE( p_box->data.p_rdrf->psz_ref[i] );
@@ -1965,17 +2069,16 @@ static int MP4_ReadBox_rdrf( stream_t *p_stream, MP4_Box_t *p_box )
 
 #ifdef MP4_VERBOSE
     msg_Dbg( p_stream,
-             "read box: \"rdrf\" type:%4.4s ref %s",
-             (char*)&p_box->data.p_rdrf->i_ref_type,
-             p_box->data.p_rdrf->psz_ref );
-
+            "read box: \"rdrf\" type:%4.4s ref %s",
+            (char*)&p_box->data.p_rdrf->i_ref_type,
+            p_box->data.p_rdrf->psz_ref );
 #endif
     MP4_READBOX_EXIT( 1 );
 }
 
 static void MP4_FreeBox_rdrf( MP4_Box_t *p_box )
 {
-    FREENULL( p_box->data.p_rdrf->psz_ref )
+    FREENULL( p_box->data.p_rdrf->psz_ref );
 }
 
 
@@ -2043,19 +2146,11 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
     if( p_drms_box && p_drms_box->data.p_sample_soun->p_drms )
     {
-        int i_ret;
-        if( config_GetInt( p_stream, "france" ) )
-        {
-            i_ret = -7;
-        }
-        else
-        {
-            i_ret= drms_init( p_drms_box->data.p_sample_soun->p_drms,
+        int i_ret = drms_init( p_drms_box->data.p_sample_soun->p_drms,
                                p_box->i_type, p_peek, i_read );
-        }
         if( i_ret )
         {
-            char *psz_error;
+            const char *psz_error;
 
             switch( i_ret )
             {
@@ -2065,12 +2160,14 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
                 case -4: psz_error = "could not get SCI data"; break;
                 case -5: psz_error = "no user key found in SCI data"; break;
                 case -6: psz_error = "invalid user key"; break;
-                case -7: psz_error = "you live in France"; break;
                 default: psz_error = "unknown error"; break;
             }
-
-            msg_Err( p_stream, "drms_init(%4.4s) failed (%s)",
-                     (char *)&p_box->i_type, psz_error );
+            if MP4_BOX_TYPE_ASCII()
+                msg_Err( p_stream, "drms_init(%4.4s) failed (%s)",
+                        (char *)&p_box->i_type, psz_error );
+            else
+                msg_Err( p_stream, "drms_init(c%3.3s) failed (%s)",
+                        (char *)&p_box->i_type+1, psz_error );
 
             drms_free( p_drms_box->data.p_sample_soun->p_drms );
             p_drms_box->data.p_sample_soun->p_drms = NULL;
@@ -2082,32 +2179,80 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_0xa9xxx( stream_t *p_stream, MP4_Box_t *p_box )
 {
-    uint16_t i_length, i_dummy;
+    uint16_t i16;
+    size_t i_length;
 
     MP4_READBOX_ENTER( MP4_Box_data_0xa9xxx_t );
 
     p_box->data.p_0xa9xxx->psz_text = NULL;
 
-    MP4_GET2BYTES( i_length );
-    MP4_GET2BYTES( i_dummy );
+    MP4_GET2BYTES( i16 );
+    i_length = i16;
 
     if( i_length > 0 )
     {
-        if( i_length > i_read ) i_length = i_read;
+        MP4_GET2BYTES( i16 );
+        if( i_length >= i_read ) i_length = i_read + 1;
 
-        p_box->data.p_0xa9xxx->psz_text = malloc( i_length + 1 );
+        p_box->data.p_0xa9xxx->psz_text = malloc( i_length );
+        if( p_box->data.p_0xa9xxx->psz_text == NULL )
+            MP4_READBOX_EXIT( 0 );
 
+        i_length--;
         memcpy( p_box->data.p_0xa9xxx->psz_text,
                 p_peek, i_length );
         p_box->data.p_0xa9xxx->psz_text[i_length] = '\0';
 
 #ifdef MP4_VERBOSE
         msg_Dbg( p_stream,
-                 "read box: \"%4.4s\" text=`%s'",
-                 (char*)&p_box->i_type,
+                 "read box: \"c%3.3s\" text=`%s'",
+                 ((char*)&p_box->i_type + 1),
                  p_box->data.p_0xa9xxx->psz_text );
 #endif
     }
+    else
+    {
+        /* try iTune/Quicktime format, rewind to start */
+        p_peek -= 2; i_read += 2;
+        // we are expecting a 'data' box
+        uint32_t i_data_len;
+        uint32_t i_data_tag;
+
+        MP4_GET4BYTES( i_data_len );
+        if( i_data_len > i_read ) i_data_len = i_read;
+        MP4_GETFOURCC( i_data_tag );
+        if( (i_data_len > 0) && (i_data_tag == VLC_FOURCC('d', 'a', 't', 'a')) )
+        {
+            /* data box contains a version/flags field */
+            uint32_t i_version;
+            uint32_t i_reserved;
+            MP4_GET4BYTES( i_version );
+            MP4_GET4BYTES( i_reserved );
+            // version should be 0, flags should be 1 for text, 0 for data
+            if( ( i_version == 0x00000001 ) && (i_data_len >= 12 ) )
+            {
+                // the rest is the text
+                i_data_len -= 12;
+                p_box->data.p_0xa9xxx->psz_text = malloc( i_data_len + 1 );
+                if( p_box->data.p_0xa9xxx->psz_text == NULL )
+                    MP4_READBOX_EXIT( 0 );
+
+                memcpy( p_box->data.p_0xa9xxx->psz_text,
+                        p_peek, i_data_len );
+                p_box->data.p_0xa9xxx->psz_text[i_data_len] = '\0';
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream,
+                 "read box: \"c%3.3s\" text=`%s'",
+                 ((char*)&p_box->i_type+1),
+                 p_box->data.p_0xa9xxx->psz_text );
+#endif
+            }
+            else
+            {
+                // TODO: handle data values for ID3 tag values, track num or cover art,etc...
+            }
+        }
+    }
 
     MP4_READBOX_EXIT( 1 );
 }
@@ -2116,6 +2261,123 @@ static void MP4_FreeBox_0xa9xxx( MP4_Box_t *p_box )
     FREENULL( p_box->data.p_0xa9xxx->psz_text );
 }
 
+/* Chapter support */
+static int MP4_ReadBox_chpl( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    MP4_Box_data_chpl_t *p_chpl;
+    uint32_t i_dummy;
+    int i;
+    MP4_READBOX_ENTER( MP4_Box_data_chpl_t );
+
+    p_chpl = p_box->data.p_chpl;
+
+    MP4_GETVERSIONFLAGS( p_chpl );
+
+    MP4_GET4BYTES( i_dummy );
+
+    MP4_GET1BYTE( p_chpl->i_chapter );
+
+    for( i = 0; i < p_chpl->i_chapter; i++ )
+    {
+        uint64_t i_start;
+        uint8_t i_len;
+        int i_copy;
+        MP4_GET8BYTES( i_start );
+        MP4_GET1BYTE( i_len );
+
+        p_chpl->chapter[i].psz_name = malloc( i_len + 1 );
+        i_copy = __MIN( i_len, i_read );
+        if( i_copy > 0 )
+            memcpy( p_chpl->chapter[i].psz_name, p_peek, i_copy );
+        p_chpl->chapter[i].psz_name[i_copy] = '\0';
+        p_chpl->chapter[i].i_start = i_start;
+
+        p_peek += i_copy;
+        i_read -= i_copy;
+    }
+    /* Bubble sort by increasing start date */
+    do
+    {
+        for( i = 0; i < p_chpl->i_chapter - 1; i++ )
+        {
+            if( p_chpl->chapter[i].i_start > p_chpl->chapter[i+1].i_start )
+            {
+                char *psz = p_chpl->chapter[i+1].psz_name;
+                int64_t i64 = p_chpl->chapter[i+1].i_start;
+
+                p_chpl->chapter[i+1].psz_name = p_chpl->chapter[i].psz_name;
+                p_chpl->chapter[i+1].i_start = p_chpl->chapter[i].i_start;
+
+                p_chpl->chapter[i].psz_name = psz;
+                p_chpl->chapter[i].i_start = i64;
+
+                i = -1;
+                break;
+            }
+        }
+    } while( i == -1 );
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"chpl\" %d chapters",
+                       p_chpl->i_chapter );
+#endif
+    MP4_READBOX_EXIT( 1 );
+}
+static void MP4_FreeBox_chpl( MP4_Box_t *p_box )
+{
+    MP4_Box_data_chpl_t *p_chpl = p_box->data.p_chpl;
+    int i;
+    for( i = 0; i < p_chpl->i_chapter; i++ )
+        free( p_chpl->chapter[i].psz_name );
+}
+
+static int MP4_ReadBox_tref_generic( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    unsigned int i;
+    MP4_READBOX_ENTER( MP4_Box_data_tref_generic_t );
+
+    p_box->data.p_tref_generic->i_track_ID = NULL;
+    p_box->data.p_tref_generic->i_entry_count = i_read / sizeof(uint32_t);
+    if( p_box->data.p_tref_generic->i_entry_count > 0 )
+        p_box->data.p_tref_generic->i_track_ID = calloc( p_box->data.p_tref_generic->i_entry_count, sizeof(uint32_t) );
+    if( p_box->data.p_tref_generic->i_track_ID == NULL )
+        MP4_READBOX_EXIT( 0 );
+
+    for( i = 0; i < p_box->data.p_tref_generic->i_entry_count; i++ )
+    {
+        MP4_GET4BYTES( p_box->data.p_tref_generic->i_track_ID[i] );
+    }
+#ifdef MP4_VERBOSE
+        msg_Dbg( p_stream, "read box: \"chap\" %d references",
+                 p_box->data.p_tref_generic->i_entry_count );
+#endif
+
+    MP4_READBOX_EXIT( 1 );
+}
+static void MP4_FreeBox_tref_generic( MP4_Box_t *p_box )
+{
+    FREENULL( p_box->data.p_tref_generic->i_track_ID );
+}
+
+static int MP4_ReadBox_meta( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    uint8_t meta_data[8];
+    int i_actually_read;
+
+    // skip over box header
+    i_actually_read = stream_Read( p_stream, meta_data, 8 );
+    if( i_actually_read < 8 )
+        return 0;
+
+    /* meta content starts with a 4 byte version/flags value (should be 0) */
+    i_actually_read = stream_Read( p_stream, meta_data, 4 );
+    if( i_actually_read < 4 )
+        return 0;
+
+    /* then it behaves like a container */
+    return MP4_ReadBoxContainerRaw( p_stream, p_box );
+}
+
 /* For generic */
 static int MP4_ReadBox_default( stream_t *p_stream, MP4_Box_t *p_box )
 {
@@ -2145,15 +2407,20 @@ static int MP4_ReadBox_default( stream_t *p_stream, MP4_Box_t *p_box )
                 return MP4_ReadBox_sample_tx3g( p_stream, p_box );
             default:
                 msg_Warn( p_stream,
-                          "unknown handler type in stsd (uncompletetly loaded)" );
+                          "unknown handler type in stsd (incompletely loaded)" );
                 return 1;
         }
     }
 
 unknown:
-    msg_Warn( p_stream,
-              "unknown box type %4.4s (uncompletetly loaded)",
-              (char*)&p_box->i_type );
+    if MP4_BOX_TYPE_ASCII()
+        msg_Warn( p_stream,
+                "unknown box type %4.4s (incompletely loaded)",
+                (char*)&p_box->i_type );
+    else
+        msg_Warn( p_stream,
+                "unknown box type c%3.3s (incompletely loaded)",
+                (char*)&p_box->i_type+1 );
 
     return 1;
 }
@@ -2162,7 +2429,7 @@ unknown:
 /****                   "Higher level" Functions                          ****/
 /**** ------------------------------------------------------------------- ****/
 
-static struct
+static const struct
 {
     uint32_t i_type;
     int  (*MP4_ReadBox_function )( stream_t *p_stream, MP4_Box_t *p_box );
@@ -2186,6 +2453,7 @@ static struct
     { FOURCC_tref,  MP4_ReadBoxContainer,   MP4_FreeBox_Common },
     { FOURCC_gmhd,  MP4_ReadBoxContainer,   MP4_FreeBox_Common },
     { FOURCC_wave,  MP4_ReadBoxContainer,   MP4_FreeBox_Common },
+    { FOURCC_ilst,  MP4_ReadBoxContainer,   MP4_FreeBox_Common },
 
     /* specific box */
     { FOURCC_ftyp,  MP4_ReadBox_ftyp,       MP4_FreeBox_ftyp },
@@ -2278,6 +2546,8 @@ static struct
 
     { FOURCC_dvc,   MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_dvp,   MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+    { FOURCC_dv5n,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+    { FOURCC_dv5p,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_VP31,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_vp31,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_h264,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
@@ -2285,6 +2555,9 @@ static struct
     { FOURCC_jpeg,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
     { FOURCC_avc1,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
 
+    { FOURCC_yv12,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+    { FOURCC_yuv2,  MP4_ReadBox_sample_vide,    MP4_FreeBox_sample_vide },
+
     { FOURCC_mp4s,  MP4_ReadBox_sample_mp4s,    MP4_FreeBox_Common },
 
     /* XXX there is 2 box where we could find this entry stbl and tref*/
@@ -2294,6 +2567,7 @@ static struct
     { FOURCC_dpnd,  MP4_ReadBox_default,   NULL },
     { FOURCC_ipir,  MP4_ReadBox_default,   NULL },
     { FOURCC_mpod,  MP4_ReadBox_default,   NULL },
+    { FOURCC_chap,  MP4_ReadBox_tref_generic,   MP4_FreeBox_tref_generic },
 
     /* found in hnti */
     { FOURCC_rtp,   MP4_ReadBox_default,   NULL },
@@ -2340,6 +2614,11 @@ static struct
     { FOURCC_0xa9ope,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
     { FOURCC_0xa9com,MP4_ReadBox_0xa9xxx,       MP4_FreeBox_0xa9xxx },
 
+    { FOURCC_chpl,   MP4_ReadBox_chpl,          MP4_FreeBox_chpl },
+
+    /* iTunes/Quicktime meta info */
+    { FOURCC_meta,  MP4_ReadBox_meta,       MP4_FreeBox_Common },
+
     /* Last entry */
     { 0,             MP4_ReadBox_default,       NULL }
 };
@@ -2355,6 +2634,9 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
     MP4_Box_t    *p_box = malloc( sizeof( MP4_Box_t ) );
     unsigned int i_index;
 
+    if( p_box == NULL )
+        return NULL;
+
     if( !MP4_ReadBoxCommon( p_stream, p_box ) )
     {
         msg_Warn( p_stream, "cannot read one box" );
@@ -2381,7 +2663,7 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
 
     if( !(MP4_Box_Function[i_index].MP4_ReadBox_function)( p_stream, p_box ) )
     {
-        free( p_box );
+        MP4_BoxFree( p_stream, p_box );
         return NULL;
     }
 
@@ -2425,9 +2707,14 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box )
         if( MP4_Box_Function[i_index].MP4_FreeBox_function == NULL )
         {
             /* Should not happen */
-            msg_Warn( s,
-                      "cannot free box %4.4s, type unknown",
-                      (char*)&p_box->i_type );
+            if MP4_BOX_TYPE_ASCII()
+                msg_Warn( s,
+                        "cannot free box %4.4s, type unknown",
+                        (char*)&p_box->i_type );
+            else
+                msg_Warn( s,
+                        "cannot free box c%3.3s, type unknown",
+                        (char*)&p_box->i_type+1 );
         }
         else
         {
@@ -2453,6 +2740,9 @@ MP4_Box_t *MP4_BoxGetRoot( stream_t *s )
     int i_result;
 
     p_root = malloc( sizeof( MP4_Box_t ) );
+    if( p_root == NULL )
+        return NULL;
+
     p_root->i_pos = 0;
     p_root->i_type = VLC_FOURCC( 'r', 'o', 'o', 't' );
     p_root->i_shortsize = 1;
@@ -2509,8 +2799,12 @@ static void __MP4_BoxDumpStructure( stream_t *s,
 
     if( !i_level )
     {
-        msg_Dbg( s, "dumping root Box \"%4.4s\"",
-                          (char*)&p_box->i_type );
+        if MP4_BOX_TYPE_ASCII()
+            msg_Dbg( s, "dumping root Box \"%4.4s\"",
+                              (char*)&p_box->i_type );
+        else
+            msg_Dbg( s, "dumping root Box \"c%3.3s\"",
+                              (char*)&p_box->i_type+1 );
     }
     else
     {
@@ -2521,10 +2815,12 @@ static void __MP4_BoxDumpStructure( stream_t *s,
         {
             str[i*5] = '|';
         }
-        sprintf( str + i_level * 5, "+ %4.4s size %d",
-                      (char*)&p_box->i_type,
-                      (uint32_t)p_box->i_size );
-
+        if MP4_BOX_TYPE_ASCII()
+            sprintf( str + i_level * 5, "+ %4.4s size %d",
+                        (char*)&p_box->i_type, (uint32_t)p_box->i_size );
+        else
+            sprintf( str + i_level * 5, "+ c%3.3s size %d",
+                        (char*)&p_box->i_type+1, (uint32_t)p_box->i_size );
         msg_Dbg( s, "%s", str );
     }
     p_child = p_box->p_first;
@@ -2600,8 +2896,9 @@ static void __get_token( char **ppsz_path, char **ppsz_token, int *pi_number )
 }
 
 static void __MP4_BoxGet( MP4_Box_t **pp_result,
-                          MP4_Box_t *p_box, char *psz_fmt, va_list args)
+                          MP4_Box_t *p_box, const char *psz_fmt, va_list args)
 {
+    char *psz_dup;
     char    *psz_path;
 
     if( !p_box )
@@ -2610,7 +2907,8 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
         return;
     }
 
-    vasprintf( &psz_path, psz_fmt, args );
+    if( vasprintf( &psz_path, psz_fmt, args ) == -1 )
+        psz_path = NULL;
 
     if( !psz_path || !psz_path[0] )
     {
@@ -2620,7 +2918,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
     }
 
 //    fprintf( stderr, "path:'%s'\n", psz_path );
-    psz_fmt = psz_path; /* keep this pointer, as it need to be unallocated */
+    psz_dup = psz_path; /* keep this pointer, as it need to be unallocated */
     for( ; ; )
     {
         char *psz_token;
@@ -2632,7 +2930,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
         if( !psz_token )
         {
             FREENULL( psz_token );
-            free( psz_fmt );
+            free( psz_dup );
             *pp_result = p_box;
             return;
         }
@@ -2647,7 +2945,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
             if( !p_box )
             {
                 free( psz_token );
-                free( psz_fmt );
+                free( psz_dup );
                 *pp_result = NULL;
                 return;
             }
@@ -2664,7 +2962,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
             if( !p_box )
             {
                 free( psz_token );
-                free( psz_fmt );
+                free( psz_dup );
                 *pp_result = NULL;
                 return;
             }
@@ -2681,7 +2979,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
                 if( !p_box )
                 {
                     free( psz_token );
-                    free( psz_fmt );
+                    free( psz_dup );
                     *pp_result = NULL;
                     return;
                 }
@@ -2705,7 +3003,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
                 if( !p_box )
                 {
                     free( psz_token );
-                    free( psz_fmt );
+                    free( psz_dup );
                     *pp_result = NULL;
                     return;
                 }
@@ -2721,7 +3019,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
         {
 //            fprintf( stderr, "Argg malformed token \"%s\"",psz_token );
             FREENULL( psz_token );
-            free( psz_fmt );
+            free( psz_dup );
             *pp_result = NULL;
             return;
         }
@@ -2739,7 +3037,7 @@ static void __MP4_BoxGet( MP4_Box_t **pp_result,
  * ex: /moov/trak[12]
  *     ../mdia
  *****************************************************************************/
-MP4_Box_t *MP4_BoxGet( MP4_Box_t *p_box, char *psz_fmt, ... )
+MP4_Box_t *MP4_BoxGet( MP4_Box_t *p_box, const char *psz_fmt, ... )
 {
     va_list args;
     MP4_Box_t *p_result;
@@ -2760,7 +3058,7 @@ MP4_Box_t *MP4_BoxGet( MP4_Box_t *p_box, char *psz_fmt, ... )
  * ex: /moov/trak[12]
  *     ../mdia
  *****************************************************************************/
-int MP4_BoxCount( MP4_Box_t *p_box, char *psz_fmt, ... )
+int MP4_BoxCount( MP4_Box_t *p_box, const char *psz_fmt, ... )
 {
     va_list args;
     int     i_count;