From a45204f5df18843674c8072f95817e24aed4ff27 Mon Sep 17 00:00:00 2001 From: "roman.artiukhin" Date: Mon, 18 Sep 2023 13:36:12 +0300 Subject: Codecs: mp4: Fix seek in files with single element in lookup_table lookup_table offset shouldn't be zero terminated. And fix possible out of bound access. Change-Id: I212a5fcc1868a2ca519b0052b170e836276fe9de --- lib/rbcodec/codecs/libm4a/demux.c | 10 ++++++---- lib/rbcodec/codecs/libm4a/m4a.c | 6 ++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/lib/rbcodec/codecs/libm4a/demux.c b/lib/rbcodec/codecs/libm4a/demux.c index 8a424c5187..47cce9857f 100644 --- a/lib/rbcodec/codecs/libm4a/demux.c +++ b/lib/rbcodec/codecs/libm4a/demux.c @@ -524,7 +524,7 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len) stream_seek(qtmovie->stream, qtmovie->res->sample_to_chunk_offset); stream_read_sample_to_chunk(qtmovie->stream, &old_first, &old_frame); stream_read_sample_to_chunk(qtmovie->stream, &new_first, &new_frame); - for (k = 1; k < numentries; ++k) + for (k = 1; k < numentries + 1; ++k) { for (; i < qtmovie->res->num_sample_to_chunks; ++i) { @@ -548,9 +548,11 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len) qtmovie->res->lookup_table[idx++].sample = frame + (k - old_first) * old_frame; } } - /* zero-terminate the lookup table */ - qtmovie->res->lookup_table[idx].sample = 0; - qtmovie->res->lookup_table[idx].offset = 0; + /* zero-terminate sample if it wasn't calculated */ + if (idx < fit_numentries) + { + qtmovie->res->lookup_table[idx].sample = 0; + } stream_seek(qtmovie->stream, current_offset); if (size_remaining) diff --git a/lib/rbcodec/codecs/libm4a/m4a.c b/lib/rbcodec/codecs/libm4a/m4a.c index b63b8bad2c..1672cf300c 100644 --- a/lib/rbcodec/codecs/libm4a/m4a.c +++ b/lib/rbcodec/codecs/libm4a/m4a.c @@ -181,8 +181,6 @@ unsigned int m4a_seek(demux_res_t* demux_res, stream_t* stream, /* Find the chunk after 'sample_i'. */ for (chunk = 1; chunk < demux_res->num_lookup_table; ++chunk) { - if (tco_tab[chunk].offset == 0) - break; if (tco_tab[chunk].sample > sample_i) break; } @@ -287,12 +285,12 @@ unsigned int m4a_seek_raw(demux_res_t* demux_res, stream_t* stream, /* We know the desired byte offset, search for the chunk right before. * Return the associated sample to this chunk as chunk_sample. */ - for (i=0; i < demux_res->num_lookup_table; ++i) + for (i = 1; i < demux_res->num_lookup_table; ++i) { if (demux_res->lookup_table[i].offset > file_loc) break; } - i = (i>0) ? i-1 : 0; /* We want the last chunk _before_ file_loc. */ + --i; /* We want the last chunk _before_ file_loc. */ *lookup_table_idx = i; chunk_sample = demux_res->lookup_table[i].sample; new_pos = demux_res->lookup_table[i].offset; -- cgit v1.2.3