fix for #188

axiomatic-systems · Sep 9, 2017 · 53499d8 · 53499d8
1 parent 5eb8cf8
commit 53499d8
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 8 deletions.
diff --git a/Source/C++/Core/Ap4AvccAtom.cpp b/Source/C++/Core/Ap4AvccAtom.cpp
@@ -152,18 +152,28 @@ AP4_AvccAtom::AP4_AvccAtom(AP4_UI32 size, const AP4_UI08* payload) :
     m_SequenceParameters.EnsureCapacity(num_seq_params);
     unsigned int cursor = 6;
     for (unsigned int i=0; i<num_seq_params; i++) {
-        m_SequenceParameters.Append(AP4_DataBuffer());
-        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
-        m_SequenceParameters[i].SetData(&payload[cursor]+2, param_length);
-        cursor += 2+param_length;
+        if (cursor+2 <= payload_size) {
+            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
+            cursor += 2;
+            if (cursor + param_length < payload_size) {
+                m_SequenceParameters.Append(AP4_DataBuffer());
+                m_SequenceParameters[i].SetData(&payload[cursor], param_length);
+                cursor += param_length;
+            }
+        }
     }
     AP4_UI08 num_pic_params = payload[cursor++];
     m_PictureParameters.EnsureCapacity(num_pic_params);
     for (unsigned int i=0; i<num_pic_params; i++) {
-        m_PictureParameters.Append(AP4_DataBuffer());
-        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
-        m_PictureParameters[i].SetData(&payload[cursor]+2, param_length);
-        cursor += 2+param_length;
+        if (cursor+2 <= payload_size) {
+            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
+            cursor += 2;
+            if (cursor + param_length < payload_size) {
+                m_PictureParameters.Append(AP4_DataBuffer());
+                m_PictureParameters[i].SetData(&payload[cursor], param_length);
+                cursor += param_length;
+            }
+        }
     }
 }
 

diff --git a/Source/C++/Core/Ap4HvccAtom.cpp b/Source/C++/Core/Ap4HvccAtom.cpp
@@ -247,6 +247,9 @@ AP4_HvccAtom::AP4_HvccAtom(AP4_UI32 size, const AP4_UI08* payload) :
 {
     // make a copy of our configuration bytes
     unsigned int payload_size = size-AP4_ATOM_HEADER_SIZE;
+
+    // keep a raw copy
+    if (payload_size < 22) return;
     m_RawBytes.SetData(payload, payload_size);
 
     // parse the payload