Changeset 0e90ac58d8d1476cfdd81eb57e2a2a0eca0e5d91

Timestamp:

03/02/08 09:48:27 (2 months ago)

Author:

Rémi Denis-Courmont <rem@videolan.org>

git-committer:

Rémi Denis-Courmont <rem@videolan.org> 1204447707 +0200

git-parent:

[4e5b503760d978de585c82d574c0f83c2fe856f1]

git-author:

Rémi Denis-Courmont <rem@videolan.org> 1204402943 +0200

Message:

Fix memory leak in case of corrupt MP4 box

Signed-off-by: Rémi Denis-Courmont <rem@videolan.org>

Files:

• modules/demux/mp4/libmp4.c (modified) (3 diffs)

modules/demux/mp4/libmp4.c

@@ -1664 +1664 @@
-}
-
+static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
+{
+    int code = 0;
+    unsigned int i;
+    uint32_t count;
+
+    MP4_READBOX_ENTER( MP4_Box_data_padb_t );
+
+    MP4_GETVERSIONFLAGS( p_box->data.p_padb );
+
+
+    MP4_GET4BYTES( p_box->data.p_padb->i_sample_count );
+    count = (p_box->data.p_padb->i_sample_count + 1) / 2;
+
+    p_box->data.p_padb->i_reserved1 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_reserved2 = calloc( count, sizeof(uint16_t) );
+    p_box->data.p_padb->i_pad1 = calloc( count, sizeof(uint16_t) );
+
+    for( i = 0; i < i_read / 2 ; i++ )
+    {
+        if( i >= count )
+            goto error;
+        p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 7 )&0x01;
+        p_box->data.p_padb->i_pad2[i] = ( (*p_peek) >> 4 )&0x07;
+        p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 3 )&0x01;
+        p_box->data.p_padb->i_pad1[i] = ( (*p_peek) )&0x07;
+
+        p_peek += 1; i_read -= 1;
+    }
+
+#ifdef MP4_VERBOSE
+    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
+                      i_read / 2 );
+
+#endif
+    code = 1;
+error:
+    MP4_READBOX_EXIT( code );
+}
+
-static void MP4_FreeBox_padb( MP4_Box_t *p_box )
-{
@@ -1670 +1711 @@
-    FREENULL( p_box->data.p_padb->i_reserved2 );
-    FREENULL( p_box->data.p_padb->i_pad1 );
-}
-
-static int MP4_ReadBox_padb( stream_t *p_stream, MP4_Box_t *p_box )
-{
-    int code = 0;
-    unsigned int i;
-    uint32_t count;
-
-    MP4_READBOX_ENTER( MP4_Box_data_padb_t );
-
-    MP4_GETVERSIONFLAGS( p_box->data.p_padb );
-
-
-    MP4_GET4BYTES( p_box->data.p_padb->i_sample_count );
-    count = (p_box->data.p_padb->i_sample_count + 1) / 2;
-
-    p_box->data.p_padb->i_reserved1 = calloc( count, sizeof(uint16_t) );
-    p_box->data.p_padb->i_pad2 = calloc( count, sizeof(uint16_t) );
-    p_box->data.p_padb->i_reserved2 = calloc( count, sizeof(uint16_t) );
-    p_box->data.p_padb->i_pad1 = calloc( count, sizeof(uint16_t) );
-
-    for( i = 0; i < i_read / 2 ; i++ )
-    {
-        if( i >= count )
-        {
-            MP4_FreeBox_padb( p_box );
-            goto error;
-        }
-        p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 7 )&0x01;
-        p_box->data.p_padb->i_pad2[i] = ( (*p_peek) >> 4 )&0x07;
-        p_box->data.p_padb->i_reserved1[i] = ( (*p_peek) >> 3 )&0x01;
-        p_box->data.p_padb->i_pad1[i] = ( (*p_peek) )&0x07;
-
-        p_peek += 1; i_read -= 1;
-    }
-
-#ifdef MP4_VERBOSE
-    msg_Dbg( p_stream, "read box: \"stdp\" entry-count "I64Fd,
-                      i_read / 2 );
-
-#endif
-    code = 1;
-error:
-    MP4_READBOX_EXIT( code );
-}
-
@@ -2585 +2582 @@
-    if( !(MP4_Box_Function[i_index].MP4_ReadBox_function)( p_stream, p_box ) )
-    {
-free(
+MP4_BoxFree( p_stream,
-        return NULL;
-    }