potential undefined behavior in OpenMP4Source()

[invd]

In OpenMP4Source(), the following three variables are defined as signed 32 bit integers:

gpmf-parser/demo/GPMF_mp4reader.c

Lines 350 to 352 in 98aff12

	int32_t segment_duration; //integer that specifies the duration of this edit segment in units of the movie�s time scale.
	int32_t segment_mediaTime; //integer containing the starting time within the media of this edit segment(in media timescale units).If this field is set to �1, it is an empty edit.The last edit in a track should never be an empty edit.Any difference between the movie�s duration and the track�s duration is expressed as an implicit empty edit.
	int32_t segment_mediaRate; //point number that specifies the relative rate at which to play the media corresponding to this edit segment.This rate value cannot be 0 or negative.

However, it appears that

• 32 bit of data is written into them via fread() and values are shifted with <<24 via the BYTESWAP32 macro
• the represented values are (likely) only supposed to be positive

This can lead to undefined behaviour. Switching the int32_t to uint32_t might be a solution, but this should be checked by someone that is more familiar with the code.

[dnewman-gpsw]

From the Quicktime spec, one of the fields can be -1. From the Quicktime spec "If this field is set to –1, it is an empty edit." Safer to test of 0xffffffff.

[invd]

Some debugging information: the runtime error: left shift of 255 by 24 places cannot be represented in type 'int' is present in the following three lines:

gpmf-parser/demo/GPMF_mp4reader.c

Lines 359 to 361 in 98aff12

	segment_duration = BYTESWAP32(segment_duration); // in MP4 clock base
	segment_mediaTime = BYTESWAP32(segment_mediaTime); // in trak clock base
	segment_mediaRate = BYTESWAP32(segment_mediaRate); // Fixed-point 65536 = 1.0X

In my opinion, value checks would have to be applied before the swapping to prevent the undefined behaviour from being reachable.

Also, note that the offset calculation can potentially overflow:
runtime error: signed integer overflow: -2097149565 + -402652929 cannot be represented in type 'int'

gpmf-parser/demo/GPMF_mp4reader.c

Line 364 in 98aff12

mp4->trak_edit_list_offsets[mp4->trak_num] += segment_duration; //samples are delay, data starts after presentation time zero.

[dnewman-gpsw]

Good feedback, fixed in the current develop branch