From a45204f5df18843674c8072f95817e24aed4ff27 Mon Sep 17 00:00:00 2001 From: "roman.artiukhin" Date: Mon, 18 Sep 2023 13:36:12 +0300 Subject: Codecs: mp4: Fix seek in files with single element in lookup_table lookup_table offset shouldn't be zero terminated. And fix possible out of bound access. Change-Id: I212a5fcc1868a2ca519b0052b170e836276fe9de --- lib/rbcodec/codecs/libm4a/demux.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'lib/rbcodec/codecs/libm4a/demux.c') diff --git a/lib/rbcodec/codecs/libm4a/demux.c b/lib/rbcodec/codecs/libm4a/demux.c index 8a424c5187..47cce9857f 100644 --- a/lib/rbcodec/codecs/libm4a/demux.c +++ b/lib/rbcodec/codecs/libm4a/demux.c @@ -524,7 +524,7 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len) stream_seek(qtmovie->stream, qtmovie->res->sample_to_chunk_offset); stream_read_sample_to_chunk(qtmovie->stream, &old_first, &old_frame); stream_read_sample_to_chunk(qtmovie->stream, &new_first, &new_frame); - for (k = 1; k < numentries; ++k) + for (k = 1; k < numentries + 1; ++k) { for (; i < qtmovie->res->num_sample_to_chunks; ++i) { @@ -548,9 +548,11 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len) qtmovie->res->lookup_table[idx++].sample = frame + (k - old_first) * old_frame; } } - /* zero-terminate the lookup table */ - qtmovie->res->lookup_table[idx].sample = 0; - qtmovie->res->lookup_table[idx].offset = 0; + /* zero-terminate sample if it wasn't calculated */ + if (idx < fit_numentries) + { + qtmovie->res->lookup_table[idx].sample = 0; + } stream_seek(qtmovie->stream, current_offset); if (size_remaining) -- cgit v1.2.3