2 files changed, 27 insertions, 11 deletions

diff --git a/apps/codecs/libm4a/demux.c b/apps/codecs/libm4a/demux.c
index 634bb4ffca..912e7327e7 100644
--- a/apps/codecs/libm4a/demux.c
+++ b/apps/codecs/libm4a/demux.c
@@ -150,14 +150,15 @@ static bool read_chunk_esds(qtmovie_t *qtmovie, size_t chunk_len)
     
     /* read length */
     qtmovie->res->codecdata_len = mp4ff_read_mp4_descr_length(qtmovie->stream);
-    qtmovie->res->codecdata = malloc(qtmovie->res->codecdata_len);
-    if (qtmovie->res->codecdata)
+    if (qtmovie->res->codecdata_len > MAX_CODECDATA_SIZE)
     {
-        stream_read(qtmovie->stream, qtmovie->res->codecdata_len, qtmovie->res->codecdata);
-    } else {
-        qtmovie->res->codecdata_len = 0;
+        DEBUGF("codecdata too large (%d) in esds\n", 
+               (int)qtmovie->res->codecdata_len);
+        return false;
     }
 
+    stream_read(qtmovie->stream, qtmovie->res->codecdata_len, qtmovie->res->codecdata);
+
     /* will skip the remainder of the atom */
     return true;
 }
@@ -225,19 +226,21 @@ static bool read_chunk_stsd(qtmovie_t *qtmovie, size_t chunk_len)
 
           /* 12 = audio format atom, 8 = padding */
           qtmovie->res->codecdata_len = entry_remaining + 12 + 8;
-          qtmovie->res->codecdata = malloc(qtmovie->res->codecdata_len);
-          
-          if (!qtmovie->res->codecdata)
+          if (qtmovie->res->codecdata_len > MAX_CODECDATA_SIZE)
           {
-             DEBUGF("stsd too large\n");
-             return false;
+             DEBUGF("codecdata too large (%d) in stsd\n", 
+                    (int)qtmovie->res->codecdata_len);
           }
 
           memset(qtmovie->res->codecdata, 0, qtmovie->res->codecdata_len);
           /* audio format atom */
+#if 0
+          /* The ALAC decoder skips these bytes, so there is no need to store them,
+             and this code isn't endian/alignment safe */
           ((unsigned int*)qtmovie->res->codecdata)[0] = 0x0c000000;
           ((unsigned int*)qtmovie->res->codecdata)[1] = MAKEFOURCC('a','m','r','f');
           ((unsigned int*)qtmovie->res->codecdata)[2] = MAKEFOURCC('c','a','l','a');
+#endif
 
           stream_read(qtmovie->stream,
                   entry_remaining,
diff --git a/apps/codecs/libm4a/m4a.h b/apps/codecs/libm4a/m4a.h
index 401cff3b7a..a4d4dc0f79 100644
--- a/apps/codecs/libm4a/m4a.h
+++ b/apps/codecs/libm4a/m4a.h
@@ -23,6 +23,19 @@
 #include <codecs.h>
 #include <inttypes.h>
 
+/* AAC codecdata appears to always be less than 8 bytes - see
+   AudioSpecificConfig2 in libfaad/mp4.c
+
+   ALAC codecdata appears to always be 44 bytes (see alac_set_info in
+   libalac/alac.c) but my test file contains 56 bytes.
+
+   So we go safe and round up to 64 bytes - if we find more than this,
+   we give an error (even though we could possibly continue), so we
+   can increase this buffer.
+*/
+
+#define MAX_CODECDATA_SIZE  64
+
 typedef struct {
   struct codec_api* ci;
   int eof;
@@ -57,7 +70,7 @@ typedef struct
     uint32_t num_sample_byte_sizes;
 
     uint32_t codecdata_len;
-    void *codecdata;
+    uint8_t codecdata[MAX_CODECDATA_SIZE];
 
     int mdat_offset;
     uint32_t mdat_len;