int32_t sampleSize;
uint16_t sampleRate;
- /* stsd */
- int32_t stsd_entry_count;
-
/* stsz */
int32_t stsz_sample_size;
int32_t stsz_sample_count;
int32_t stco_entry_count;
int32_t *stco_chunk_offset;
- /* ctts */
- int32_t ctts_entry_count;
- int32_t *ctts_sample_count;
- int32_t *ctts_sample_offset;
-
- uint32_t maxBitrate;
- uint32_t avgBitrate;
-
uint32_t timeScale;
uint64_t duration;
};
return 1;
}
-static int32_t read_ctts(struct mp4 *f)
-{
- int32_t i;
- struct mp4_track *t;
-
- if (f->total_tracks == 0)
- return f->error++;
- t = f->track[f->total_tracks - 1];
- if (t->ctts_entry_count)
- return 0;
-
- read_char(f); /* version */
- read_int24(f); /* flags */
- t->ctts_entry_count = read_int32(f);
-
- t->ctts_sample_count = para_malloc(t->ctts_entry_count
- * sizeof (int32_t));
- t->ctts_sample_offset = para_malloc(t->ctts_entry_count
- * sizeof (int32_t));
-
- /* CVE-2017-9257 */
- for (i = 0; i < t->ctts_entry_count && !f->stream->read_error; i++) {
- t->ctts_sample_count[i] = read_int32(f);
- t->ctts_sample_offset[i] = read_int32(f);
- }
- return 1;
-}
-
static int32_t read_stsc(struct mp4 *f)
{
int32_t i;
static int32_t read_stsd(struct mp4 *f)
{
- int32_t i;
+ int32_t i, entry_count;
uint8_t header_size = 0;
struct mp4_track *t;
read_char(f); /* version */
read_int24(f); /* flags */
- t->stsd_entry_count = read_int32(f);
+ entry_count = read_int32(f);
/* CVE-2017-9253 */
- for (i = 0; i < t->stsd_entry_count && !f->stream->read_error; i++) {
+ for (i = 0; i < entry_count && !f->stream->read_error; i++) {
uint64_t skip = get_position(f);
uint64_t size;
uint8_t atom_type = 0;
} else if (atom_type == ATOM_STTS) {
/* time to sample box */
read_stts(f);
- } else if (atom_type == ATOM_CTTS) {
- /* composition offset box */
- read_ctts(f);
} else if (atom_type == ATOM_STSC) {
/* sample to chunk box */
read_stsc(f);
free(ff->track[i]->stsc_samples_per_chunk);
free(ff->track[i]->stsc_sample_desc_index);
free(ff->track[i]->stco_chunk_offset);
- free(ff->track[i]->ctts_sample_count);
- free(ff->track[i]->ctts_sample_offset);
free(ff->track[i]);
}
}