devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

Codecs: mp4: Fix seek in files with single element in lookup_table

Browse source 
lookup_table offset shouldn't be zero terminated.
And fix possible out of bound access.

Change-Id: I212a5fcc1868a2ca519b0052b170e836276fe9de
This commit is contained in:
roman.artiukhin 2023-09-18 13:36:12 +03:00 • committed by Solomon Peachy
parent 57a47ef67a
commit a45204f5df
2 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/rbcodec/codecs/libm4a/demux.c
View file

@ -524,7 +524,7 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len)
stream_seek(qtmovie->stream, qtmovie->res->sample_to_chunk_offset); stream_seek(qtmovie->stream, qtmovie->res->sample_to_chunk_offset);
stream_read_sample_to_chunk(qtmovie->stream, &old_first, &old_frame); stream_read_sample_to_chunk(qtmovie->stream, &old_first, &old_frame);
stream_read_sample_to_chunk(qtmovie->stream, &new_first, &new_frame); stream_read_sample_to_chunk(qtmovie->stream, &new_first, &new_frame);
for (k = 1; k < numentries; ++k) for (k = 1; k < numentries + 1; ++k)
{ {
for (; i < qtmovie->res->num_sample_to_chunks; ++i) for (; i < qtmovie->res->num_sample_to_chunks; ++i)
{ {
@ -548,9 +548,11 @@ static bool read_chunk_stco(qtmovie_t *qtmovie, size_t chunk_len)
qtmovie->res->lookup_table[idx++].sample = frame + (k - old_first) * old_frame; qtmovie->res->lookup_table[idx++].sample = frame + (k - old_first) * old_frame;
} }
} }
/* zero-terminate the lookup table */ /* zero-terminate sample if it wasn't calculated */
qtmovie->res->lookup_table[idx].sample = 0; if (idx < fit_numentries)
qtmovie->res->lookup_table[idx].offset = 0; {
qtmovie->res->lookup_table[idx].sample = 0;
}
stream_seek(qtmovie->stream, current_offset); stream_seek(qtmovie->stream, current_offset);
if (size_remaining) if (size_remaining)

6
lib/rbcodec/codecs/libm4a/m4a.c
View file

@ -181,8 +181,6 @@ unsigned int m4a_seek(demux_res_t* demux_res, stream_t* stream,
/* Find the chunk after 'sample_i'. */ /* Find the chunk after 'sample_i'. */
for (chunk = 1; chunk < demux_res->num_lookup_table; ++chunk) for (chunk = 1; chunk < demux_res->num_lookup_table; ++chunk)
{ {
if (tco_tab[chunk].offset == 0)
break;
if (tco_tab[chunk].sample > sample_i) if (tco_tab[chunk].sample > sample_i)
break; break;
} }
@ -287,12 +285,12 @@ unsigned int m4a_seek_raw(demux_res_t* demux_res, stream_t* stream,
/* We know the desired byte offset, search for the chunk right before. /* We know the desired byte offset, search for the chunk right before.
* Return the associated sample to this chunk as chunk_sample. */ * Return the associated sample to this chunk as chunk_sample. */
for (i=0; i < demux_res->num_lookup_table; ++i) for (i = 1; i < demux_res->num_lookup_table; ++i)
{ {
if (demux_res->lookup_table[i].offset > file_loc) if (demux_res->lookup_table[i].offset > file_loc)
break; break;
} }
i = (i>0) ? i-1 : 0; /* We want the last chunk _before_ file_loc. */ --i; /* We want the last chunk _before_ file_loc. */
*lookup_table_idx = i; *lookup_table_idx = i;
chunk_sample = demux_res->lookup_table[i].sample; chunk_sample = demux_res->lookup_table[i].sample;
new_pos = demux_res->lookup_table[i].offset; new_pos = demux_res->lookup_table[i].offset;