[demuxers/Mp4] Factorize, check for duplicate stbl and stsd entries

Loading crafted mp4 files with multiple duplicated atoms led to crashes and memleaks. Ignore all but the first sample description.
mean00 · Jan 19, 2024 · cdbfa69 · cdbfa69
1 parent 0b1eda5
commit cdbfa69
Show file tree

Hide file tree

Showing 5 changed files with 1,169 additions and 941 deletions.
diff --git a/avidemux_plugins/ADM_demuxers/Mp4/ADM_atom.cpp b/avidemux_plugins/ADM_demuxers/Mp4/ADM_atom.cpp
@@ -52,8 +52,16 @@ adm_atom::adm_atom(adm_atom *atom)
 		_atomFCC=read32();
 	}
 
-	if (fourCC::check(_atomFCC, (uint8_t *)"tadm") && _atomSize == 1)	// mdat
+	if ( /* fourCC::check(_atomFCC, (uint8_t *)"tadm") && */ _atomSize == 1) // extended size
+	{
 		_atomSize=read64();
+		printf("Atom \"%s\" using extended size: %" PRIu64"\n", fourCC::tostringBE(_atomFCC), _atomSize);
+		ADM_assert(_atomSize >= 16);
+	} else if (_atomSize < 8)
+	{
+		printf("Atom \"%s\" too short: %" PRIu64", crashing.\n", fourCC::tostringBE(_atomFCC), _atomSize);
+		ADM_assert(0);
+	}
 
 #ifdef ATOM_DEBUG
 	dumpAtom();
@@ -113,7 +121,12 @@ int64_t pos;
 
 	fseeko(_fd,nb,SEEK_CUR);
 	pos=ftello(_fd);
-	if(pos>_atomStart+_atomSize+1) ADM_assert(0);
+	if(pos>_atomStart+_atomSize+1)
+	{
+		printf("Atom: invalid attempt to skip %" PRIu32" bytes starting at offset %" PRIu64", atom \"%s\" at %" PRIu64" of size %" PRIu64"\n",
+			nb, pos, fourCC::tostringBE(_atomFCC), _atomStart, _atomSize);
+		ADM_assert(0);
+	}
 	return 1;
 }
 
@@ -203,9 +216,9 @@ bool adm_atom::skipAtom( void )
 {
 	fseeko(_fd,_atomStart+_atomSize,SEEK_SET);
 #ifdef _3G_LOGO
-        printf("skipping to %x ending atom ",_atomStart+_atomSize);
+        printf("skipping to the end of atom ");
         fourCC::printBE(_atomFCC);
-        printf("\n");
+        printf(" at %" PRIu64"\n",_atomStart+_atomSize);
 #endif
 	return 1;
 

diff --git a/avidemux_plugins/ADM_demuxers/Mp4/ADM_atom.h b/avidemux_plugins/ADM_demuxers/Mp4/ADM_atom.h
@@ -53,4 +53,4 @@ class adm_atom
                                 }
 
 };
-// eof
+// eof
diff --git a/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp b/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp
@@ -421,7 +421,7 @@ uint8_t    MP4Header::open(const char *name)
         }
         //**************
 
-        if(!lookupMainAtoms((void*) atom))
+        if(!lookupMainAtoms(atom))
         {
           printf("Cannot find needed atom\n");   
           if(!_tracks[0].fragments.size() || !indexVideoFragments(0))

diff --git a/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.h b/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.h
@@ -203,20 +203,21 @@ class MP4Header         :public vidHeader
           bool                          indexAudioFragments(int trackNo);
           /*****************************/
           uint64_t                      delayRelativeToVideo;
-          uint8_t                       lookupMainAtoms(void *tom);
-          void                          parseMvhd(void *tom);
-          uint8_t                       parseTrex(void *ztom);
-          uint8_t                       parseTrack(void *ztom);
-          uint8_t                       parseElst(void *tom,int64_t *delay,int64_t *skip);
+          uint8_t                       lookupMainAtoms(adm_atom *tom);
+          void                          parseMvhd(adm_atom *tom);
+          uint8_t                       parseTrex(adm_atom *tom);
+          uint8_t                       parseTrack(adm_atom *tom);
+          uint8_t                       parseElst(adm_atom *tom, int64_t *delay, int64_t *skip);
           bool                          parseMoof(adm_atom &son);
           bool                          parseTraf(adm_atom &son,uint64_t moofStart);
           int                           lookupIndex(int desc)          ;
           bool                          parseTrun(int trackNo,adm_atom &son,const mp4TrafInfo &info);
-          uint8_t                       decodeVideoAtom(void *ztom);
-          uint8_t                       parseMdia(void *ztom,uint32_t *trackType,uint32_t *trackId);
-          uint8_t                       parseEdts(void *ztom,uint32_t trackType);
-          uint8_t                       parseStbl(void *ztom,uint32_t trackType,uint32_t trackScale);
-          uint8_t                       decodeEsds(void *ztom,uint32_t trackType);
+          uint8_t                       parseHdlr(adm_atom *tom, uint32_t *trackType, uint32_t *trackId, uint32_t trackScale, uint32_t trackDuration, std::string *language);
+          uint8_t                       parseMdia(adm_atom *tom, uint32_t *trackType, uint32_t *trackId);
+          uint8_t                       parseEdts(adm_atom *tom, uint32_t trackType);
+          uint8_t                       parseStbl(adm_atom *tom, uint32_t trackType, uint32_t trackScale);
+          uint8_t                       parseStsd(adm_atom *tom, MPsampleinfo *info, uint32_t trackType, uint32_t trackScale);
+          uint8_t                       decodeEsds(adm_atom *tom, uint32_t trackType);
           uint8_t                       updateCtts(MPsampleinfo *info );
 #ifdef DERIVE_TB_FROM_MINIMUM_DELTA
           bool                          refineFps(void);