From 3c67112290fec8460f7789e2d8d0b00a114439b1 Mon Sep 17 00:00:00 2001 From: Francois Cartegnie Date: Fri, 16 Nov 2018 14:20:50 +0100 Subject: [PATCH] demux: libmp4: fix iref 2 bytes references read --- modules/demux/mp4/libmp4.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c index 37953e43b0..24781f497f 100644 --- a/modules/demux/mp4/libmp4.c +++ b/modules/demux/mp4/libmp4.c @@ -4244,8 +4244,8 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box ) else MP4_GET4BYTES( p_data->i_from_item_id ); MP4_GET2BYTES( p_data->i_reference_count ); - - if( i_read / sizeof(*p_data->p_references) < p_data->i_reference_count ) + if( i_read / ((p_box->p_father->data.p_iref->i_flags == 0 ) ? 2 : 4) < + p_data->i_reference_count ) MP4_READBOX_EXIT( 0 ); p_data->p_references = malloc( sizeof(*p_data->p_references) * @@ -4254,7 +4254,7 @@ static int MP4_ReadBox_Reference( stream_t *p_stream, MP4_Box_t *p_box ) MP4_READBOX_EXIT( 0 ); for( uint16_t i=0; ii_reference_count; i++ ) { - if( p_box->p_father->data.p_iref == 0 ) + if( p_box->p_father->data.p_iref->i_flags == 0 ) MP4_GET2BYTES( p_data->p_references[i].i_to_item_id ); else MP4_GET4BYTES( p_data->p_references[i].i_to_item_id ); -- 2.11.4.GIT