fixed potential crash in traf merging when packed samples are used

gpac · Sep 11, 2019 · e4ed32b · e4ed32b
1 parent 442c9f7
commit e4ed32b
Showing 1 changed file with 6 additions and 5 deletions.
diff --git a/src/isomedia/stbl_write.c b/src/isomedia/stbl_write.c
@@ -1513,11 +1513,11 @@ void stbl_AppendSize(GF_SampleTableBox *stbl, u32 size, u32 nb_pack)
 		stbl->SampleSize->sampleCount += nb_pack;
 		return;
 	}
-	if (!stbl->SampleSize->sizes || (stbl->SampleSize->sampleCount==stbl->SampleSize->alloc_size)) {
+	if (!stbl->SampleSize->sizes || (stbl->SampleSize->sampleCount+nb_pack > stbl->SampleSize->alloc_size)) {
 		Bool init_table = (stbl->SampleSize->sizes==NULL) ? 1 : 0;
 		ALLOC_INC(stbl->SampleSize->alloc_size);
-		if (stbl->SampleSize->sampleCount >= stbl->SampleSize->alloc_size)
-			stbl->SampleSize->alloc_size = stbl->SampleSize->sampleCount+1;
+		if (stbl->SampleSize->sampleCount+nb_pack > stbl->SampleSize->alloc_size)
+			stbl->SampleSize->alloc_size = stbl->SampleSize->sampleCount+nb_pack;
 
 		stbl->SampleSize->sizes = (u32 *)gf_realloc(stbl->SampleSize->sizes, sizeof(u32)*stbl->SampleSize->alloc_size);
 		if (!stbl->SampleSize->sizes) return;
@@ -1529,8 +1529,9 @@ void stbl_AppendSize(GF_SampleTableBox *stbl, u32 size, u32 nb_pack)
 		}
 	}
 	stbl->SampleSize->sampleSize = 0;
-	stbl->SampleSize->sizes[stbl->SampleSize->sampleCount] = size;
-
+	for (i=0; i<nb_pack; i++) {
+		stbl->SampleSize->sizes[stbl->SampleSize->sampleCount+i] = size;
+	}
 	stbl->SampleSize->sampleCount += nb_pack;
 	if (size > stbl->SampleSize->max_size)
 		stbl->SampleSize->max_size = size;