From ba67168b4ab7a05a45111791b179776bca016c43 Mon Sep 17 00:00:00 2001 From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= Date: Sun, 16 Mar 2008 23:15:40 +0200 Subject: [PATCH] Handle memory errors in MP4 stts - fixes #1502 --- modules/demux/mp4/libmp4.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c index b28a989622..e96fdd0f1d 100644 --- a/modules/demux/mp4/libmp4.c +++ b/modules/demux/mp4/libmp4.c @@ -782,10 +782,15 @@ static int MP4_ReadBox_dref( stream_t *p_stream, MP4_Box_t *p_box ) MP4_READBOX_EXIT( 1 ); } +static void MP4_FreeBox_stts( MP4_Box_t *p_box ) +{ + FREENULL( p_box->data.p_stts->i_sample_count ); + FREENULL( p_box->data.p_stts->i_sample_delta ); +} static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) { - unsigned int i; + unsigned int i, code = 0; MP4_READBOX_ENTER( MP4_Box_data_stts_t ); MP4_GETVERSIONFLAGS( p_box->data.p_stts ); @@ -795,6 +800,12 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) ); p_box->data.p_stts->i_sample_delta = calloc( p_box->data.p_stts->i_entry_count, sizeof(uint32_t) ); + if( p_box->data.p_stts->i_sample_count == NULL + || p_box->data.p_stts->i_sample_delta == NULL ) + { + MP4_FreeBox_stts( p_box ); + goto error; + } for( i = 0; (i < p_box->data.p_stts->i_entry_count )&&( i_read >=8 ); i++ ) { @@ -807,13 +818,9 @@ static int MP4_ReadBox_stts( stream_t *p_stream, MP4_Box_t *p_box ) p_box->data.p_stts->i_entry_count ); #endif - MP4_READBOX_EXIT( 1 ); -} - -static void MP4_FreeBox_stts( MP4_Box_t *p_box ) -{ - FREENULL( p_box->data.p_stts->i_sample_count ); - FREENULL( p_box->data.p_stts->i_sample_delta ); + code = 1; +error: + MP4_READBOX_EXIT( code ); } static int MP4_ReadBox_ctts( stream_t *p_stream, MP4_Box_t *p_box ) -- 2.39.2