X-Git-Url: http://git.tuebingen.mpg.de/?a=blobdiff_plain;f=mp4.c;h=c77cedd2bd2fb586a715b12c5808f7691bc35c57;hb=8e2a58f85f68077944bb5739f2327353a502ed70;hp=bec0371035f5adf1bc1afb20429852305fe1342f;hpb=fa02aa1d7ab03948198dad8329ea0bcf6b176a60;p=paraslash.git

diff --git a/mp4.c b/mp4.c
index bec03710..c77cedd2 100644
--- a/mp4.c
+++ b/mp4.c
@@ -8,34 +8,32 @@
 #include <regex.h>
 
 #include "para.h"
+#include "error.h"
 #include "portable_io.h"
 #include "string.h"
 #include "mp4.h"
 
 struct mp4_track {
-	bool is_audio;
-	int32_t channelCount;
+	uint16_t channelCount;
 	uint16_t sampleRate;
 
 	/* stsz */
-	int32_t stsz_sample_size;
-	int32_t stsz_sample_count;
-	int32_t *stsz_table;
+	uint32_t stsz_sample_size;
+	uint32_t stsz_sample_count;
+	uint32_t *stsz_table;
 
 	/* stts */
-	int32_t stts_entry_count;
-	int32_t *stts_sample_count;
-	int32_t *stts_sample_delta;
+	uint32_t stts_entry_count;
+	uint32_t *stts_sample_count;
 
 	/* stsc */
-	int32_t stsc_entry_count;
-	int32_t *stsc_first_chunk;
-	int32_t *stsc_samples_per_chunk;
-	int32_t *stsc_sample_desc_index;
+	uint32_t stsc_entry_count;
+	uint32_t *stsc_first_chunk;
+	uint32_t *stsc_samples_per_chunk;
 
 	/* stsc */
-	int32_t stco_entry_count;
-	int32_t *stco_chunk_offset;
+	uint32_t stco_entry_count;
+	uint32_t *stco_chunk_offset;
 
 	uint32_t timeScale;
 	uint64_t duration;
@@ -52,44 +50,84 @@ struct mp4 {
 	uint8_t last_atom;
 	uint64_t file_size;
 
-	uint32_t read_error;
-	uint32_t error;
-
 	/* incremental track index while reading the file */
 	int32_t total_tracks;
-
 	/* track data */
 	struct mp4_track *track[MAX_TRACKS];
+	/* the first audio track found */
+	struct mp4_track *audio_track;
 
 	/* metadata */
 	struct mp4_metadata meta;
 };
 
-int32_t mp4_total_tracks(const struct mp4 *f)
+/*
+ * Returns -1, 0, or 1 on errors/EOF/success. Partial reads followed by EOF or
+ * read errors are treated as errors.
+ */
+static int read_data(struct mp4 *f, void *data, size_t size)
 {
-	return f->total_tracks;
+	while (size > 0) {
+		ssize_t ret = f->cb->read(f->cb->user_data, data, size);
+		if (ret < 0 && errno == EINTR)
+			continue;
+		/* regard EAGAIN as an error as reads should be blocking. */
+		if (ret <= 0)
+			return ret < 0? -1 : 0;
+		f->current_position += ret;
+		size -= ret;
+	}
+	return 1;
 }
 
-static int32_t read_data(struct mp4 *f, void *data, uint32_t size)
+static int read_int64(struct mp4 *f, uint64_t *result)
 {
-	int32_t result = 1;
+	uint8_t data[8];
+	int ret = read_data(f, data, 8);
 
-	result = f->cb->read(f->cb->user_data, data, size);
+	if (ret > 0 && result)
+		*result = read_u64_be(data);
+	return ret;
+}
 
-	if (result < size)
-		f->read_error++;
+static int read_int32(struct mp4 *f, uint32_t *result)
+{
+	uint8_t data[4];
+	int ret = read_data(f, data, 4);
 
-	f->current_position += size;
+	if (ret > 0 && result)
+		*result = read_u32_be(data);
+	return ret;
+}
 
-	return result;
+static int read_int24(struct mp4 *f, uint32_t *result)
+{
+	uint8_t data[3];
+	int ret = read_data(f, data, 3);
+
+	if (ret > 0 && result)
+		*result = read_u24_be(data);
+	return ret;
 }
 
-static uint64_t read_int64(struct mp4 *f)
+static int read_int16(struct mp4 *f, uint16_t *result)
 {
-	uint8_t data[8];
+	uint8_t data[2];
+	int ret = read_data(f, data, 2);
+
+	if (ret > 0 && result)
+		*result = read_u16_be(data);
+	return ret;
+}
+
+static uint8_t read_int8(struct mp4 *f, uint8_t *result)
+{
+	uint8_t data[1];
+	int ret = read_data(f, data, 1);
 
-	read_data(f, data, 8);
-	return read_u64_be(data);
+	if (ret > 0 && result)
+		*result = data[0];
+	return ret;
 }
 
 static bool atom_compare(int8_t a1, int8_t b1, int8_t c1, int8_t d1,
@@ -97,6 +135,7 @@ static bool atom_compare(int8_t a1, int8_t b1, int8_t c1, int8_t d1,
 {
 	return a1 == a2 && b1 == b2 && c1 == c2 && d1 == d2;
 }
+
 enum atoms {
 	/* atoms with subatoms */
 	ATOM_MOOV = 1,
@@ -133,16 +172,16 @@ enum atoms {
 	ATOM_MVHD = 131,
 	ATOM_TKHD = 132,
 	ATOM_TREF = 133,
-	ATOM_MDHD = 134,
+	ATOM_MDHD = 134, /* track header */
 	ATOM_VMHD = 135,
 	ATOM_SMHD = 136,
 	ATOM_HMHD = 137,
-	ATOM_STSD = 138,
-	ATOM_STTS = 139,
-	ATOM_STSZ = 140,
+	ATOM_STSD = 138, /* sample description box */
+	ATOM_STTS = 139, /* time to sample box */
+	ATOM_STSZ = 140, /* sample size box */
 	ATOM_STZ2 = 141,
-	ATOM_STCO = 142,
-	ATOM_STSC = 143,
+	ATOM_STCO = 142, /* chunk offset box */
+	ATOM_STSC = 143, /* sample to chunk box */
 	ATOM_MP4A = 144,
 	ATOM_MP4V = 145,
 	ATOM_MP4S = 146,
@@ -335,29 +374,33 @@ static uint8_t atom_name_to_type(int8_t a, int8_t b, int8_t c, int8_t d)
 		return ATOM_UNKNOWN;
 }
 
-/* read atom header, return atom size, atom size is with header included */
-static uint64_t atom_read_header(struct mp4 *f, uint8_t * atom_type,
-				uint8_t * header_size)
+/* read atom header, atom size is returned with header included. */
+static int atom_read_header(struct mp4 *f, uint8_t *atom_type,
+		uint8_t *header_size, uint64_t *atom_size)
 {
-	uint64_t size;
-	int32_t ret;
+	uint32_t size;
+	int ret;
 	int8_t atom_header[8];
 
 	ret = read_data(f, atom_header, 8);
-	if (ret != 8)
-		return 0;
-
+	if (ret <= 0)
+		return ret;
 	size = read_u32_be(atom_header);
-	*header_size = 8;
-
-	/* check for 64 bit atom size */
-	if (size == 1) {
-		*header_size = 16;
-		size = read_int64(f);
+	if (size == 1) { /* 64 bit atom size */
+		if (header_size)
+			*header_size = 16;
+		ret = read_int64(f, atom_size);
+		if (ret <= 0)
+			return ret;
+	} else {
+		if (header_size)
+			*header_size = 8;
+		if (atom_size)
+			*atom_size = size;
 	}
 	*atom_type = atom_name_to_type(atom_header[4], atom_header[5],
 		atom_header[6], atom_header[7]);
-	return size;
+	return 1;
 }
 
 static int64_t get_position(const struct mp4 *f)
@@ -394,206 +437,217 @@ static int32_t set_position(struct mp4 *f, int64_t position)
 	return 0;
 }
 
-static void track_add(struct mp4 *f)
-{
-	f->total_tracks++;
-
-	if (f->total_tracks > MAX_TRACKS) {
-		f->total_tracks = 0;
-		f->error++;
-		return;
-	}
-	f->track[f->total_tracks - 1] = para_calloc(sizeof(struct mp4_track));
-}
-
-static uint8_t read_char(struct mp4 *f)
-{
-	uint8_t output;
-	read_data(f, &output, 1);
-	return output;
-}
-
-static uint32_t read_int24(struct mp4 *f)
-{
-	int8_t data[4];
-
-	read_data(f, data, 3);
-	return read_u24_be(data);
-}
-
-static uint32_t read_int32(struct mp4 *f)
-{
-	int8_t data[4];
-
-	read_data(f, data, 4);
-	return read_u32_be(data);
-}
-
-static int32_t read_stsz(struct mp4 *f)
+static int read_stsz(struct mp4 *f)
 {
+	int ret;
 	int32_t i;
 	struct mp4_track *t;
 
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-	t->stsz_sample_size = read_int32(f);
-	t->stsz_sample_count = read_int32(f);
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &t->stsz_sample_size);
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &t->stsz_sample_count);
+	if (ret <= 0)
+		return ret;
 	if (t->stsz_sample_size != 0)
-		return 0;
+		return 1;
 	t->stsz_table = para_malloc(t->stsz_sample_count * sizeof(int32_t));
-	for (i = 0; i < t->stsz_sample_count && !f->read_error; i++)
-		t->stsz_table[i] = read_int32(f);
-	return 0;
+	for (i = 0; i < t->stsz_sample_count; i++) {
+		ret = read_int32(f, &t->stsz_table[i]);
+		if (ret <= 0)
+			return ret;
+	}
+	return 1;
 }
 
-static int32_t read_stts(struct mp4 *f)
+static int read_stts(struct mp4 *f)
 {
+	int ret;
 	int32_t i;
 	struct mp4_track *t;
 
-	/* CVE-2017-9223 */
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
 	if (t->stts_entry_count)
 		return 0;
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-	t->stts_entry_count = read_int32(f);
-
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &t->stts_entry_count);
+	if (ret <= 0)
+		return ret;
 	t->stts_sample_count = para_malloc(t->stts_entry_count
 		* sizeof(int32_t));
-	t->stts_sample_delta = para_malloc(t->stts_entry_count
-		* sizeof (int32_t));
-	/* CVE-2017-9254 */
-	for (i = 0; i < t->stts_entry_count && !f->read_error; i++) {
-		t->stts_sample_count[i] = read_int32(f);
-		t->stts_sample_delta[i] = read_int32(f);
+	for (i = 0; i < t->stts_entry_count; i++) {
+		ret = read_int32(f, &t->stts_sample_count[i]);
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, NULL); /* sample delta */
+		if (ret <= 0)
+			return ret;
 	}
 	return 1;
 }
 
-static int32_t read_stsc(struct mp4 *f)
+static int read_stsc(struct mp4 *f)
 {
+	int ret;
 	int32_t i;
 	struct mp4_track *t;
 
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
 
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-	t->stsc_entry_count = read_int32(f);
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &t->stsc_entry_count);
+	if (ret <= 0)
+		return ret;
 	t->stsc_first_chunk = para_malloc(t->stsc_entry_count * sizeof(int32_t));
 	t->stsc_samples_per_chunk = para_malloc(t->stsc_entry_count
 		* sizeof (int32_t));
-	t->stsc_sample_desc_index = para_malloc(t->stsc_entry_count *
-		sizeof (int32_t));
-
-	/* CVE-2017-9255 */
-	for (i = 0; i < t->stsc_entry_count && !f->read_error; i++) {
-		t->stsc_first_chunk[i] = read_int32(f);
-		t->stsc_samples_per_chunk[i] = read_int32(f);
-		t->stsc_sample_desc_index[i] = read_int32(f);
+	for (i = 0; i < t->stsc_entry_count; i++) {
+		ret = read_int32(f, &t->stsc_first_chunk[i]);
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, &t->stsc_samples_per_chunk[i]);
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, NULL); /* sample desc index */
+		if (ret <= 0)
+			return ret;
 	}
-	return 0;
+	return 1;
 }
 
-static int32_t read_stco(struct mp4 *f)
+static int read_stco(struct mp4 *f)
 {
+	int ret;
 	int32_t i;
 	struct mp4_track *t;
 
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
 
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-	t->stco_entry_count = read_int32(f);
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &t->stco_entry_count);
+	if (ret <= 0)
+		return ret;
 	t->stco_chunk_offset = para_malloc(t->stco_entry_count
 		* sizeof(int32_t));
-	/* CVE-2017-9256 */
-	for (i = 0; i < t->stco_entry_count && !f->read_error; i++)
-		t->stco_chunk_offset[i] = read_int32(f);
-	return 0;
-}
-
-static uint16_t read_int16(struct mp4 *f)
-{
-	int8_t data[2];
-
-	read_data(f, data, 2);
-	return read_u16_be(data);
+	for (i = 0; i < t->stco_entry_count; i++) {
+		ret = read_int32(f, &t->stco_chunk_offset[i]);
+		if (ret <= 0)
+			return ret;
+	}
+	return 1;
 }
 
-static int32_t read_mp4a(struct mp4 *f)
+static int read_mp4a(struct mp4 *f)
 {
+	int ret;
 	int32_t i;
 	uint8_t atom_type = 0;
 	uint8_t header_size = 0;
 	struct mp4_track *t;
 
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
 
 	for (i = 0; i < 6; i++) {
-		read_char(f);	/* reserved */
+		ret = read_int8(f, NULL); /* reserved */
+		if (ret <= 0)
+			return ret;
 	}
-	/* data_reference_index */ read_int16(f);
-
-	read_int32(f);	/* reserved */
-	read_int32(f);	/* reserved */
-
-	t->channelCount = read_int16(f);
-	read_int16(f);
-
-	read_int16(f);
-	read_int16(f);
-
-	t->sampleRate = read_int16(f);
-
-	read_int16(f);
-
-	atom_read_header(f, &atom_type, &header_size);
-	return 0;
-}
-
-static int32_t read_stsd(struct mp4 *f)
-{
-	int32_t i, entry_count;
+	ret = read_int16(f, NULL); /* data_reference_index */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, NULL); /* reserved */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, NULL); /* reserved */
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, &t->channelCount);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, &t->sampleRate);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
+	return atom_read_header(f, &atom_type, &header_size, NULL);
+}
+
+static int read_stsd(struct mp4 *f)
+{
+	int ret;
+	uint32_t i, entry_count;
 	uint8_t header_size = 0;
 	struct mp4_track *t;
 
-	/* CVE-2017-9218 */
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
-
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-
-	entry_count = read_int32(f);
-
-	/* CVE-2017-9253 */
-	for (i = 0; i < entry_count && !f->read_error; i++) {
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
+	ret = read_int32(f, &entry_count);
+	if (ret <= 0)
+		return ret;
+	for (i = 0; i < entry_count; i++) {
 		uint64_t skip = get_position(f);
 		uint64_t size;
 		uint8_t atom_type = 0;
-		size = atom_read_header(f, &atom_type, &header_size);
+		ret = atom_read_header(f, &atom_type, &header_size, &size);
+		if (ret <= 0)
+			return ret;
 		skip += size;
-		t->is_audio = atom_type == ATOM_MP4A;
-		if (t->is_audio)
+		if (!f->audio_track && atom_type == ATOM_MP4A) {
+			f->audio_track = t;
 			read_mp4a(f);
+		}
 		set_position(f, skip);
 	}
-
-	return 0;
+	return 1;
 }
 
 static int32_t tag_add_field(struct mp4_metadata *meta, const char *item,
@@ -614,15 +668,19 @@ static int32_t tag_add_field(struct mp4_metadata *meta, const char *item,
 	return 1;
 }
 
-static char *read_string(struct mp4 *f, uint32_t length)
+static int read_string(struct mp4 *f, uint32_t length, char **result)
 {
 	char *str = para_malloc(length + 1);
-	if ((uint32_t)read_data(f, str, length) != length) {
+	int ret = read_data(f, str, length);
+
+	if (ret <= 0) {
 		free(str);
-		str = NULL;
-	} else
-		str[length] = 0;
-	return str;
+		*result = NULL;
+	} else {
+		str[length] = '\0';
+		*result = str;
+	}
+	return ret;
 }
 
 static const char *get_metadata_name(uint8_t atom_type)
@@ -637,8 +695,9 @@ static const char *get_metadata_name(uint8_t atom_type)
 	}
 }
 
-static void parse_tag(struct mp4 *f, uint8_t parent, int32_t size)
+static int parse_tag(struct mp4 *f, uint8_t parent, int32_t size)
 {
+	int ret;
 	uint64_t subsize, sumsize;
 	char *data = NULL;
 	uint32_t len = 0;
@@ -646,70 +705,104 @@ static void parse_tag(struct mp4 *f, uint8_t parent, int32_t size)
 
 	for (
 		sumsize = 0;
-		sumsize < size && !f->read_error; /* CVE-2017-9222 */
+		sumsize < size;
 		set_position(f, destpos), sumsize += subsize
 	) {
 		uint8_t atom_type;
 		uint8_t header_size = 0;
-		subsize = atom_read_header(f, &atom_type, &header_size);
+		ret = atom_read_header(f, &atom_type, &header_size, &subsize);
+		if (ret <= 0)
+			return ret;
 		destpos = get_position(f) + subsize - header_size;
 		if (atom_type != ATOM_DATA)
 			continue;
-		read_char(f);	/* version */
-		read_int24(f);	/* flags */
-		read_int32(f);	/* reserved */
+		ret = read_int8(f, NULL); /* version */
+		if (ret <= 0)
+			return ret;
+		ret = read_int24(f, NULL); /* flags */
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, NULL); /* reserved */
+		if (ret <= 0)
+			return ret;
 		free(data);
-		data = read_string(f, subsize - (header_size + 8));
+		ret = read_string(f, subsize - (header_size + 8), &data);
+		if (ret <= 0)
+			return ret;
 		len = subsize - (header_size + 8);
 	}
 	if (!data)
-		return;
+		return -1;
 	tag_add_field(&f->meta, get_metadata_name(parent), data, len);
 	free(data);
+	return 1;
 }
 
-static int32_t read_mdhd(struct mp4 *f)
+static int read_mdhd(struct mp4 *f)
 {
+	int ret;
 	uint32_t version;
 	struct mp4_track *t;
 
-	/* CVE-2017-9221 */
 	if (f->total_tracks == 0)
-		return f->error++;
+		return -1;
 	t = f->track[f->total_tracks - 1];
 
-	version = read_int32(f);
+	ret = read_int32(f, &version);
+	if (ret <= 0)
+		return ret;
 	if (version == 1) {
-		read_int64(f); //creation-time
-		read_int64(f); //modification-time
-		t->timeScale = read_int32(f); //timescale
-		t->duration = read_int64(f); //duration
+		ret = read_int64(f, NULL); /* creation-time */
+		if (ret <= 0)
+			return ret;
+		ret = read_int64(f, NULL); /* modification-time */
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, &t->timeScale);
+		if (ret <= 0)
+			return ret;
+		ret = read_int64(f, &t->duration);
+		if (ret <= 0)
+			return ret;
 	} else { //version == 0
 		uint32_t temp;
 
-		read_int32(f);	//creation-time
-		read_int32(f);	//modification-time
-		t->timeScale = read_int32(f); //timescale
-		temp = read_int32(f);
+		ret = read_int32(f, NULL); /* creation-time */
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, NULL); /* modification-time */
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, &t->timeScale);
+		if (ret <= 0)
+			return ret;
+		ret = read_int32(f, &temp);
+		if (ret <= 0)
+			return ret;
 		t->duration = (temp == (uint32_t) (-1))?
 			(uint64_t) (-1) : (uint64_t) (temp);
 	}
-	read_int16(f);
-	read_int16(f);
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
+	ret = read_int16(f, NULL);
+	if (ret <= 0)
+		return ret;
 	return 1;
 }
 
 static int32_t read_ilst(struct mp4 *f, int32_t size)
 {
+	int ret;
 	uint64_t sumsize = 0;
 
 	while (sumsize < size) {
 		uint8_t atom_type;
 		uint64_t subsize, destpos;
 		uint8_t header_size = 0;
-		subsize = atom_read_header(f, &atom_type, &header_size);
-		if (subsize == 0)
-			break;
+		ret = atom_read_header(f, &atom_type, &header_size, &subsize);
+		if (ret <= 0)
+			return ret;
 		destpos = get_position(f) + subsize - header_size;
 		switch (atom_type) {
 		case ATOM_ARTIST:
@@ -722,21 +815,26 @@ static int32_t read_ilst(struct mp4 *f, int32_t size)
 		set_position(f, destpos);
 		sumsize += subsize;
 	}
-
-	return 0;
+	return 1;
 }
 
 static int32_t read_meta(struct mp4 *f, uint64_t size)
 {
+	int ret;
 	uint64_t subsize, sumsize = 0;
 	uint8_t atom_type;
 	uint8_t header_size = 0;
 
-	read_char(f);	/* version */
-	read_int24(f);	/* flags */
-
+	ret = read_int8(f, NULL); /* version */
+	if (ret <= 0)
+		return ret;
+	ret = read_int24(f, NULL); /* flags */
+	if (ret <= 0)
+		return ret;
 	while (sumsize < (size - (header_size + 4))) {
-		subsize = atom_read_header(f, &atom_type, &header_size);
+		ret = atom_read_header(f, &atom_type, &header_size, &subsize);
+		if (ret <= 0)
+			return ret;
 		if (subsize <= header_size + 4)
 			return 1;
 		if (atom_type == ATOM_ILST)
@@ -745,86 +843,77 @@ static int32_t read_meta(struct mp4 *f, uint64_t size)
 			set_position(f, get_position(f) + subsize - header_size);
 		sumsize += subsize;
 	}
-
-	return 0;
+	return 1;
 }
 
-static int32_t atom_read(struct mp4 *f, int32_t size, uint8_t atom_type)
+static int atom_read(struct mp4 *f, uint64_t size, uint8_t atom_type)
 {
 	uint64_t dest_position = get_position(f) + size - 8;
-	if (atom_type == ATOM_STSZ) {
-		/* sample size box */
-		read_stsz(f);
-	} else if (atom_type == ATOM_STTS) {
-		/* time to sample box */
-		read_stts(f);
-	} else if (atom_type == ATOM_STSC) {
-		/* sample to chunk box */
-		read_stsc(f);
-	} else if (atom_type == ATOM_STCO) {
-		/* chunk offset box */
-		read_stco(f);
-	} else if (atom_type == ATOM_STSD) {
-		/* sample description box */
-		read_stsd(f);
-	} else if (atom_type == ATOM_MDHD) {
-		/* track header */
-		read_mdhd(f);
-	} else if (atom_type == ATOM_META) {
-		/* iTunes Metadata box */
-		read_meta(f, size);
-	}
+	int ret = 1; /* return success for atoms we don't care about */
 
+	switch (atom_type) {
+	case ATOM_STSZ: ret = read_stsz(f); break;
+	case ATOM_STTS: ret = read_stts(f); break;
+	case ATOM_STSC: ret = read_stsc(f); break;
+	case ATOM_STCO: ret = read_stco(f); break;
+	case ATOM_STSD: ret = read_stsd(f); break;
+	case ATOM_MDHD: ret = read_mdhd(f); break;
+	case ATOM_META: ret = read_meta(f, size); break;
+	}
 	set_position(f, dest_position);
-	return 0;
+	return ret;
 }
 
 /* parse atoms that are sub atoms of other atoms */
-static int32_t parse_sub_atoms(struct mp4 *f, uint64_t total_size, int meta_only)
+static int parse_sub_atoms(struct mp4 *f, uint64_t total_size, int meta_only)
 {
+	int ret;
 	uint64_t size;
 	uint8_t atom_type = 0;
 	uint64_t counted_size = 0;
 	uint8_t header_size = 0;
 
 	while (counted_size < total_size) {
-		size = atom_read_header(f, &atom_type, &header_size);
-		counted_size += size;
-
-		/* check for end of file */
+		ret = atom_read_header(f, &atom_type, &header_size, &size);
+		if (ret <= 0)
+			return ret;
 		if (size == 0)
-			break;
-
-		/* we're starting to read a new track, update index,
-		 * so that all data and tables get written in the right place
-		 */
-		if (atom_type == ATOM_TRAK)
-			track_add(f);
+			return -1;
+		counted_size += size;
+		if (atom_type == ATOM_TRAK) {
+			if (f->total_tracks >= MAX_TRACKS)
+				return -1;
+			f->total_tracks++;
+			f->track[f->total_tracks - 1] = para_calloc(
+				sizeof(struct mp4_track));
+		}
 		/* parse subatoms */
 		if (meta_only && !need_parse_when_meta_only(atom_type)) {
 			set_position(f, get_position(f) + size - header_size);
 		} else if (atom_type < SUBATOMIC) {
-			parse_sub_atoms(f, size - header_size, meta_only);
+			ret = parse_sub_atoms(f, size - header_size, meta_only);
+			if (ret <= 0)
+				return ret;
 		} else {
-			atom_read(f, (uint32_t) size, atom_type);
+			ret = atom_read(f, size, atom_type);
+			if (ret <= 0)
+				return ret;
 		}
 	}
-
-	return 0;
+	return 1;
 }
 
 /* parse root atoms */
-static int32_t parse_atoms(struct mp4 *f, int meta_only)
+static int parse_atoms(struct mp4 *f, int meta_only)
 {
+	int ret;
 	uint64_t size;
 	uint8_t atom_type = 0;
 	uint8_t header_size = 0;
 
 	f->file_size = 0;
-	f->read_error = 0;
 
-	while ((size =
-		atom_read_header(f, &atom_type, &header_size)) != 0) {
+	while ((ret = atom_read_header(f, &atom_type, &header_size, &size)) > 0) {
 		f->file_size += size;
 		f->last_atom = atom_type;
 
@@ -837,25 +926,31 @@ static int32_t parse_atoms(struct mp4 *f, int meta_only)
 		if (meta_only && !need_parse_when_meta_only(atom_type)) {
 			set_position(f, get_position(f) + size - header_size);
 		} else if (atom_type < SUBATOMIC) {
-			parse_sub_atoms(f, size - header_size, meta_only);
+			ret = parse_sub_atoms(f, size - header_size, meta_only);
+			if (ret <= 0)
+				break;
 		} else {
 			/* skip this atom */
 			set_position(f, get_position(f) + size - header_size);
 		}
 	}
-
-	return 0;
+	if (ret < 0)
+		return ret;
+	if (!f->audio_track)
+		return -E_MP4_TRACK;
+	return ret;
 }
 
 struct mp4 *mp4_open_read(const struct mp4_callback *cb)
 {
+	int ret;
 	struct mp4 *f = para_calloc(sizeof(struct mp4));
 
 	f->cb = cb;
-	parse_atoms(f, 0);
-	if (f->error) {
+	ret = parse_atoms(f, 0);
+	if (ret < 0) {
 		free(f);
-		f = NULL;
+		return NULL;
 	}
 	return f;
 }
@@ -868,10 +963,8 @@ void mp4_close(struct mp4 *f)
 		if (f->track[i]) {
 			free(f->track[i]->stsz_table);
 			free(f->track[i]->stts_sample_count);
-			free(f->track[i]->stts_sample_delta);
 			free(f->track[i]->stsc_first_chunk);
 			free(f->track[i]->stsc_samples_per_chunk);
-			free(f->track[i]->stsc_sample_desc_index);
 			free(f->track[i]->stco_chunk_offset);
 			free(f->track[i]);
 		}
@@ -884,179 +977,106 @@ void mp4_close(struct mp4 *f)
 	free(f);
 }
 
-static int32_t chunk_of_sample(const struct mp4 *f, int32_t track,
-		int32_t sample, int32_t *chunk_sample, int32_t *chunk)
+static int32_t chunk_of_sample(const struct mp4 *f, int32_t sample,
+		int32_t *chunk)
 {
-	int32_t total_entries = 0;
-	int32_t chunk2entry;
-	int32_t chunk1, chunk2, chunk1samples, range_samples, total = 0;
-
-	*chunk_sample = 0;
-	*chunk = 1;
-	if (f->track[track] == NULL) {
-		return -1;
-	}
-
-	total_entries = f->track[track]->stsc_entry_count;
+	const struct mp4_track *t = f->audio_track;
+	uint32_t *fc = t->stsc_first_chunk, *spc = t->stsc_samples_per_chunk;
+	int32_t chunk1, chunk1samples, n, total, i;
 
-	chunk1 = 1;
-	chunk1samples = 0;
-	chunk2entry = 0;
-
-	do {
-		chunk2 = f->track[track]->stsc_first_chunk[chunk2entry];
-		*chunk = chunk2 - chunk1;
-		range_samples = *chunk * chunk1samples;
-
-		if (sample < total + range_samples)
+	for (i = 1, total = 0; i < t->stsc_entry_count; i++, total += n) {
+		n = (fc[i] - fc[i - 1]) * spc[i - 1]; /* number of samples */
+		if (sample < total + n)
 			break;
-
-		chunk1samples = f->track[track]->stsc_samples_per_chunk[chunk2entry];
-		chunk1 = chunk2;
-
-		if (chunk2entry < total_entries) {
-			chunk2entry++;
-			total += range_samples;
-		}
-	} while (chunk2entry < total_entries);
-
-	if (chunk1samples)
+	}
+	chunk1 = fc[i - 1];
+	chunk1samples = spc[i - 1];
+	if (chunk1samples != 0)
 		*chunk = (sample - total) / chunk1samples + chunk1;
 	else
 		*chunk = 1;
-
-	*chunk_sample = total + (*chunk - chunk1) * chunk1samples;
-
-	return 0;
-}
-
-static int32_t chunk_to_offset(const struct mp4 *f, int32_t track,
-		int32_t chunk)
-{
-	const struct mp4_track *p_track = f->track[track];
-
-	if (p_track->stco_entry_count && (chunk > p_track->stco_entry_count)) {
-		return p_track->stco_chunk_offset[p_track->stco_entry_count -
-						  1];
-	} else if (p_track->stco_entry_count) {
-		return p_track->stco_chunk_offset[chunk - 1];
-	} else {
-		return 8;
-	}
-
-	return 0;
-}
-
-static int32_t sample_range_size(const struct mp4 *f, int32_t track,
-		int32_t chunk_sample, int32_t sample)
-{
-	int32_t i, total;
-	const struct mp4_track *p_track = f->track[track];
-
-	if (p_track->stsz_sample_size) {
-		return (sample - chunk_sample) * p_track->stsz_sample_size;
-	} else {
-		if (sample >= p_track->stsz_sample_count)
-			return 0;	//error
-
-		for (i = chunk_sample, total = 0; i < sample; i++) {
-			total += p_track->stsz_table[i];
-		}
-	}
-
-	return total;
-}
-
-static int32_t sample_to_offset(const struct mp4 *f, int32_t track,
-		int32_t sample)
-{
-	int32_t chunk, chunk_sample, chunk_offset1, chunk_offset2;
-
-	chunk_of_sample(f, track, sample, &chunk_sample, &chunk);
-
-	chunk_offset1 = chunk_to_offset(f, track, chunk);
-	chunk_offset2 = chunk_offset1 + sample_range_size(f,
-		track, chunk_sample, sample);
-	return chunk_offset2;
+	return total + (*chunk - chunk1) * chunk1samples;
 }
 
 /**
- * Return the number of milliseconds of the given track.
+ * Return the number of milliseconds of the audio track.
  *
  * \param f As returned by \ref mp4_open_read(), must not be NULL.
- * \param track Between zero and the value returned by \ref mp4_total_tracks().
- *
- * The function returns zero if the audio file is of zero length or contains a
- * corrupt track header.
  */
-uint64_t mp4_get_duration(const struct mp4 *f, int32_t track)
+uint64_t mp4_get_duration(const struct mp4 *f)
 {
-	const struct mp4_track *t = f->track[track];
+	const struct mp4_track *t = f->audio_track;
 
 	if (t->timeScale == 0)
 		return 0;
 	return t->duration * 1000 / t->timeScale;
 }
 
-/**
- * Check whether the given track number corresponds to an audio track.
- *
- * \param f See \ref mp4_get_duration().
- * \param track See \ref mp4_get_duration().
- *
- * Besides audio tracks, an mp4 file may contain video and system tracks. For
- * those the function returns false.
- */
-bool mp4_is_audio_track(const struct mp4 *f, int32_t track)
+int mp4_set_sample_position(struct mp4 *f, int32_t sample)
 {
-	return f->track[track]->is_audio;
-}
+	const struct mp4_track *t = f->audio_track;
+	int32_t offset, chunk, chunk_sample;
+	uint32_t n, srs; /* sample range size */
 
-void mp4_set_sample_position(struct mp4 *f, int32_t track, int32_t sample)
-{
-	int32_t offset = sample_to_offset(f, track, sample);
-	set_position(f, offset);
+	if (sample >= t->stsz_sample_count)
+		return -ERRNO_TO_PARA_ERROR(EINVAL);
+	chunk_sample = chunk_of_sample(f, sample, &chunk);
+	if (t->stsz_sample_size > 0)
+		srs = (sample - chunk_sample) * t->stsz_sample_size;
+	else {
+		for (srs = 0, n = chunk_sample; n < sample; n++)
+			srs += t->stsz_table[n];
+	}
+	if (t->stco_entry_count > 0 && chunk > t->stco_entry_count)
+		offset = t->stco_chunk_offset[t->stco_entry_count - 1];
+	else if (t->stco_entry_count > 0)
+		offset = t->stco_chunk_offset[chunk - 1];
+	else
+		offset = 8;
+	set_position(f, offset + srs);
+	return 1;
 }
 
-int32_t mp4_get_sample_size(const struct mp4 *f, int track, int sample)
+int32_t mp4_get_sample_size(const struct mp4 *f, int sample)
 {
-	const struct mp4_track *t = f->track[track];
+	const struct mp4_track *t = f->audio_track;
 
 	if (t->stsz_sample_size != 0)
 		return t->stsz_sample_size;
 	return t->stsz_table[sample];
 }
 
-uint32_t mp4_get_sample_rate(const struct mp4 *f, int32_t track)
+uint32_t mp4_get_sample_rate(const struct mp4 *f)
 {
-	return f->track[track]->sampleRate;
+	return f->audio_track->sampleRate;
 }
 
-uint32_t mp4_get_channel_count(const struct mp4 *f, int32_t track)
+uint32_t mp4_get_channel_count(const struct mp4 *f)
 {
-	return f->track[track]->channelCount;
+	return f->audio_track->channelCount ;
 }
 
-int32_t mp4_num_samples(const struct mp4 *f, int32_t track)
+int32_t mp4_num_samples(const struct mp4 *f)
 {
+	const struct mp4_track *t = f->audio_track;
 	int32_t i;
 	int32_t total = 0;
 
-	for (i = 0; i < f->track[track]->stts_entry_count; i++) {
-		total += f->track[track]->stts_sample_count[i];
-	}
+	for (i = 0; i < t->stts_entry_count; i++)
+		total += t->stts_sample_count[i];
 	return total;
 }
 
 struct mp4 *mp4_open_meta(const struct mp4_callback *cb)
 {
+	int ret;
 	struct mp4 *f = para_calloc(sizeof(struct mp4));
 
 	f->cb = cb;
-	parse_atoms(f, 1);
-	if (f->error) {
+	ret = parse_atoms(f, 1);
+	if (ret < 0) {
 		free(f);
-		f = NULL;
+		return NULL;
 	}
 	return f;
 }
@@ -1074,44 +1094,59 @@ struct mp4_metadata *mp4_get_meta(struct mp4 *f)
 	return &f->meta;
 }
 
-static uint32_t find_atom(struct mp4 *f, uint64_t base, uint32_t size,
-			  const char *name)
+static int find_atom(struct mp4 *f, uint64_t base, uint32_t size,
+	const char *name)
 {
 	uint32_t remaining = size;
 	uint64_t atom_offset = base;
+
 	for (;;) {
+		int ret;
 		char atom_name[4];
 		uint32_t atom_size;
 
 		set_position(f, atom_offset);
 
 		if (remaining < 8)
-			break;
-		atom_size = read_int32(f);
+			return -1;
+		ret = read_int32(f, &atom_size);
+		if (ret <= 0)
+			return ret;
 		if (atom_size > remaining || atom_size < 8)
-			break;
-		read_data(f, atom_name, 4);
-
+			return -1;
+		ret = read_data(f, atom_name, 4);
+		if (ret <= 0)
+			return ret;
 		if (!memcmp(atom_name, name, 4)) {
 			set_position(f, atom_offset);
 			return 1;
 		}
-
 		remaining -= atom_size;
 		atom_offset += atom_size;
 	}
-	return 0;
 }
 
-static uint32_t find_atom_v2(struct mp4 *f, uint64_t base, uint32_t size,
+/*
+ * Try to find atom <name> with atom <name_inside> in it. Besides -1/0/1 for
+ * error, EOF and success, this function may return 2 to indicate that the
+ * desired atoms were not found.
+ */
+static int find_atom_v2(struct mp4 *f, uint64_t base, uint32_t size,
 		const char *name, uint32_t extraheaders, const char *name_inside)
 {
 	uint64_t first_base = (uint64_t) (-1);
-	while (find_atom(f, base, size, name))	//try to find atom <name> with atom <name_inside> in it
-	{
-		uint64_t mybase = get_position(f);
-		uint32_t mysize = read_int32(f);
 
+	for (;;) {
+		uint64_t mybase;
+		uint32_t mysize;
+		int ret = find_atom(f, base, size, name);
+
+		if (ret <= 0)
+			return ret;
+		mybase = get_position(f);
+		ret = read_int32(f, &mysize);
+		if (ret <= 0)
+			return ret;
 		if (first_base == (uint64_t) (-1))
 			first_base = mybase;
 
@@ -1121,50 +1156,41 @@ static uint32_t find_atom_v2(struct mp4 *f, uint64_t base, uint32_t size,
 		if (find_atom (f, mybase + (8 + extraheaders),
 				mysize - (8 + extraheaders), name_inside)) {
 			set_position(f, mybase);
-			return 2;
+			return 1;
 		}
 		base += mysize;
-		if (size <= mysize) {
-			size = 0;
+		if (size <= mysize)
 			break;
-		}
 		size -= mysize;
 	}
-
-	if (first_base != (uint64_t) (-1))	//wanted atom inside not found
-	{
+	if (first_base != (uint64_t)(-1)) {
 		set_position(f, first_base);
 		return 1;
-	} else
-		return 0;
+	}
+	/* wanted atom inside not found */
+	return 2;
 }
 
 struct membuffer {
 	void *data;
 	unsigned written;
 	unsigned allocated;
-	unsigned error;
 };
 
 static struct membuffer *membuffer_create(void)
 {
-	const unsigned initial_size = 256;
-
-	struct membuffer *buf = para_malloc(sizeof(*buf));
-	buf->data = para_malloc(initial_size);
-	buf->written = 0;
-	buf->allocated = initial_size;
-	buf->error = buf->data == 0 ? 1 : 0;
+	struct membuffer *buf = para_calloc(sizeof(*buf));
 
+	buf->allocated = 256;
+	buf->data = para_malloc(buf->allocated);
 	return buf;
 }
 
-static unsigned membuffer_write(struct membuffer *buf, const void *ptr, unsigned bytes)
+static void membuffer_write(struct membuffer *buf, const void *ptr,
+		unsigned bytes)
 {
 	unsigned dest_size = buf->written + bytes;
 
-	if (buf->error)
-		return 0;
 	if (dest_size > buf->allocated) {
 		do {
 			buf->allocated <<= 1;
@@ -1175,19 +1201,18 @@ static unsigned membuffer_write(struct membuffer *buf, const void *ptr, unsigned
 	if (ptr)
 		memcpy((char *) buf->data + buf->written, ptr, bytes);
 	buf->written += bytes;
-	return bytes;
 }
 
-static unsigned membuffer_write_atom_name(struct membuffer *buf, const char *data)
+static void membuffer_write_atom_name(struct membuffer *buf, const char *data)
 {
-	return membuffer_write(buf, data, 4) == 4 ? 1 : 0;
+	membuffer_write(buf, data, 4);
 }
 
-static unsigned membuffer_write_int32(struct membuffer *buf, uint32_t data)
+static void membuffer_write_int32(struct membuffer *buf, uint32_t data)
 {
 	uint8_t temp[4];
 	write_u32_be(temp, data);
-	return membuffer_write(buf, temp, 4);
+	membuffer_write(buf, temp, 4);
 }
 
 static void membuffer_write_std_tag(struct membuffer *buf, const char *name,
@@ -1208,17 +1233,6 @@ static void membuffer_write_std_tag(struct membuffer *buf, const char *name,
 	membuffer_write(buf, value, len);
 }
 
-static unsigned membuffer_error(const struct membuffer *buf)
-{
-	return buf->error;
-}
-
-static void membuffer_free(struct membuffer *buf)
-{
-	free(buf->data);
-	free(buf);
-}
-
 static unsigned membuffer_get_size(const struct membuffer *buf)
 {
 	return buf->written;
@@ -1226,13 +1240,8 @@ static unsigned membuffer_get_size(const struct membuffer *buf)
 
 static void *membuffer_detach(struct membuffer *buf)
 {
-	void *ret;
-
-	if (buf->error)
-		return 0;
-	ret = para_realloc(buf->data, buf->written);
-	buf->data = 0;
-	buf->error = 1;
+	void *ret = para_realloc(buf->data, buf->written);
+	free(buf);
 	return ret;
 }
 
@@ -1271,15 +1280,8 @@ static uint32_t create_ilst(const struct mp4_metadata *meta, void **out_buffer,
 		else
 			PARA_ERROR_LOG("invalid tag item: %s\n", tag->item);
 	}
-	if (membuffer_error(buf)) {
-		membuffer_free(buf);
-		return 0;
-	}
-
 	*out_size = membuffer_get_size(buf);
 	*out_buffer = membuffer_detach(buf);
-	membuffer_free(buf);
-
 	return 1;
 }
 
@@ -1296,32 +1298,20 @@ static void *membuffer_get_ptr(const struct membuffer *buf)
 	return buf->data;
 }
 
-static void membuffer_set_error(struct membuffer *buf)
-{
-	buf->error = 1;
-}
-
-static unsigned membuffer_transfer_from_file(struct membuffer *buf, struct mp4 *src,
+static bool membuffer_transfer_from_file(struct membuffer *buf, struct mp4 *src,
 		unsigned bytes)
 {
-	unsigned oldsize;
-	void *bufptr;
-
-	oldsize = membuffer_get_size(buf);
-	if (membuffer_write(buf, 0, bytes) != bytes)
-		return 0;
+	unsigned oldsize = membuffer_get_size(buf);
+	char *bufptr;
 
+	membuffer_write(buf, 0, bytes);
 	bufptr = membuffer_get_ptr(buf);
-	if (bufptr == 0)
-		return 0;
-
-	if ((unsigned)read_data(src, (char *) bufptr + oldsize, bytes) !=
-		bytes) {
-		membuffer_set_error(buf);
-		return 0;
+	if (read_data(src, bufptr + oldsize, bytes) != 1) {
+		free(buf->data);
+		free(buf);
+		return false;
 	}
-
-	return bytes;
+	return true;
 }
 
 static uint32_t create_meta(const struct mp4_metadata *meta, void **out_buffer,
@@ -1342,7 +1332,6 @@ static uint32_t create_meta(const struct mp4_metadata *meta, void **out_buffer,
 
 	*out_size = membuffer_get_size(buf);
 	*out_buffer = membuffer_detach(buf);
-	membuffer_free(buf);
 	return 1;
 }
 
@@ -1364,7 +1353,6 @@ uint32_t * out_size)
 
 	*out_size = membuffer_get_size(buf);
 	*out_buffer = membuffer_detach(buf);
-	membuffer_free(buf);
 	return 1;
 }
 
@@ -1373,108 +1361,145 @@ static uint32_t fix_byte_order_32(uint32_t src)
 	return read_u32_be(&src);
 }
 
-static uint32_t modify_moov(struct mp4 *f, void **out_buffer,
-		uint32_t *out_size)
+static void *modify_moov(struct mp4 *f, uint32_t *out_size)
 {
+	int ret;
 	uint64_t total_base = f->moov_offset + 8;
 	uint32_t total_size = (uint32_t) (f->moov_size - 8);
-
 	uint64_t udta_offset, meta_offset, ilst_offset;
 	uint32_t udta_size, meta_size, ilst_size;
-
 	uint32_t new_ilst_size;
-	void *new_ilst_buffer;
-
+	void *new_ilst_buffer, *out_buffer;
 	uint8_t *p_out;
 	int32_t size_delta;
+	uint32_t tmp;
 
-	if (!find_atom_v2(f, total_base, total_size, "udta", 0, "meta")) {
+	ret = find_atom_v2(f, total_base, total_size, "udta", 0, "meta");
+	if (ret <= 0)
+		return NULL;
+	if (ret == 2) {
 		struct membuffer *buf;
 		void *new_udta_buffer;
 		uint32_t new_udta_size;
 		if (!create_udta(&f->meta, &new_udta_buffer, &new_udta_size))
-			return 0;
+			return NULL;
 
 		buf = membuffer_create();
 		set_position(f, total_base);
-		membuffer_transfer_from_file(buf, f, total_size);
-
+		if (!membuffer_transfer_from_file(buf, f, total_size)) {
+			free(new_udta_buffer);
+			return NULL;
+		}
 		membuffer_write_atom(buf, "udta", new_udta_size,
 			new_udta_buffer);
 
 		free(new_udta_buffer);
 
 		*out_size = membuffer_get_size(buf);
-		*out_buffer = membuffer_detach(buf);
-		membuffer_free(buf);
-		return 1;
+		return membuffer_detach(buf);
 	}
 	udta_offset = get_position(f);
-	udta_size = read_int32(f);
-	if (!find_atom_v2 (f, udta_offset + 8, udta_size - 8, "meta", 4, "ilst")) {
+	ret = read_int32(f, &udta_size);
+	if (ret <= 0)
+		return NULL;
+	ret = find_atom_v2(f, udta_offset + 8, udta_size - 8, "meta", 4, "ilst");
+	if (ret <= 0)
+		return NULL;
+	if (ret == 2) {
 		struct membuffer *buf;
 		void *new_meta_buffer;
 		uint32_t new_meta_size;
 
 		if (!create_meta(&f->meta, &new_meta_buffer, &new_meta_size))
-			return 0;
+			return NULL;
 
 		buf = membuffer_create();
 		set_position(f, total_base);
-		membuffer_transfer_from_file(buf, f,
-			(uint32_t)(udta_offset - total_base));
+		if (!membuffer_transfer_from_file(buf, f,
+				udta_offset - total_base)) {
+			free(new_meta_buffer);
+			return NULL;
+		}
 
 		membuffer_write_int32(buf, udta_size + 8 + new_meta_size);
 		membuffer_write_atom_name(buf, "udta");
-		membuffer_transfer_from_file(buf, f, udta_size);
-
+		if (!membuffer_transfer_from_file(buf, f, udta_size)) {
+			free(new_meta_buffer);
+			return NULL;
+		}
 		membuffer_write_atom(buf, "meta", new_meta_size,
 			new_meta_buffer);
 		free(new_meta_buffer);
 
 		*out_size = membuffer_get_size(buf);
-		*out_buffer = membuffer_detach(buf);
-		membuffer_free(buf);
-		return 1;
+		return membuffer_detach(buf);
 	}
 	meta_offset = get_position(f);
-	meta_size = read_int32(f);
+	ret = read_int32(f, &meta_size);
+	if (ret <= 0)
+		return NULL;
+ 	/* shouldn't happen, find_atom_v2 above takes care of it */
 	if (!find_atom(f, meta_offset + 12, meta_size - 12, "ilst"))
-		return 0; /* shouldn't happen, find_atom_v2 above takes care of it */
+		return NULL;
 	ilst_offset = get_position(f);
-	ilst_size = read_int32(f);
+	ret = read_int32(f, &ilst_size);
+	if (ret <= 0)
+		return NULL;
 	if (!create_ilst(&f->meta, &new_ilst_buffer, &new_ilst_size))
-		return 0;
+		return NULL;
 	size_delta = new_ilst_size - (ilst_size - 8);
 	*out_size = total_size + size_delta;
-	*out_buffer = para_malloc(*out_size);
-	p_out = (uint8_t *)*out_buffer;
+	out_buffer = para_malloc(*out_size);
+	p_out = out_buffer;
 	set_position(f, total_base);
-	read_data(f, p_out, (uint32_t) (udta_offset - total_base));
+	ret = read_data(f, p_out, udta_offset - total_base);
+	if (ret <= 0)
+		return NULL;
 	p_out += (uint32_t) (udta_offset - total_base);
-	*(uint32_t *)p_out = fix_byte_order_32(read_int32(f) + size_delta);
+	ret = read_int32(f, &tmp);
+	if (ret <= 0)
+		return NULL;
+	*(uint32_t *)p_out = fix_byte_order_32(tmp + size_delta);
 	p_out += 4;
-	read_data(f, p_out, 4);
+	ret = read_data(f, p_out, 4);
+	if (ret <= 0)
+		return NULL;
 	p_out += 4;
-	read_data(f, p_out, (uint32_t) (meta_offset - udta_offset - 8));
+	ret = read_data(f, p_out, meta_offset - udta_offset - 8);
+	if (ret <= 0)
+		return NULL;
 	p_out += (uint32_t) (meta_offset - udta_offset - 8);
-	*(uint32_t *)p_out = fix_byte_order_32(read_int32(f) + size_delta);
+	ret = read_int32(f, &tmp);
+	if (ret <= 0)
+		return NULL;
+	*(uint32_t *)p_out = fix_byte_order_32(tmp + size_delta);
 	p_out += 4;
-	read_data(f, p_out, 4);
+	ret = read_data(f, p_out, 4);
+	if (ret <= 0)
+		return NULL;
 	p_out += 4;
-	read_data(f, p_out, (uint32_t) (ilst_offset - meta_offset - 8));
+	ret = read_data(f, p_out, ilst_offset - meta_offset - 8);
+	if (ret <= 0)
+		return NULL;
 	p_out += (uint32_t) (ilst_offset - meta_offset - 8);
-	*(uint32_t *)p_out = fix_byte_order_32(read_int32(f) + size_delta);
+	ret = read_int32(f, &tmp);
+	if (ret <= 0)
+		return NULL;
+	*(uint32_t *)p_out = fix_byte_order_32(tmp + size_delta);
 	p_out += 4;
-	read_data(f, p_out, 4);
+	ret = read_data(f, p_out, 4);
+	if (ret <= 0)
+		return NULL;
 	p_out += 4;
 	memcpy(p_out, new_ilst_buffer, new_ilst_size);
 	p_out += new_ilst_size;
 	set_position(f, ilst_offset + ilst_size);
-	read_data(f, p_out, (uint32_t) (total_size
-		- (ilst_offset - total_base) - ilst_size));
+	ret = read_data(f, p_out, total_size
+		- (ilst_offset - total_base) - ilst_size);
+	if (ret <= 0)
+		return NULL;
 	free(new_ilst_buffer);
-	return 1;
+	return out_buffer;
 }
 
 static int32_t write_data(struct mp4 *f, void *data, uint32_t size)
@@ -1501,7 +1526,8 @@ int32_t mp4_meta_update(struct mp4 *f)
 	uint32_t new_moov_size;
 
 	set_position(f, 0);
-	if (!modify_moov(f, &new_moov_data, &new_moov_size)) {
+	new_moov_data = modify_moov(f, &new_moov_size);
+	if (!new_moov_data ) {
 		mp4_close(f);
 		return 0;
 	}