From 60bc77cc358fb5c20a93722d94e502d3f0fa4991 Mon Sep 17 00:00:00 2001
From: Edward Hervey <edward@centricular.com>
Date: Thu, 22 Mar 2018 15:20:47 +0100
Subject: [PATCH] qtdemux: Check sample count is valid in PIFF parsing

The value stored in cenc_aux_sample_count wasn't in sync with the
parsing code that followed which checks whether all entries are
valid and present.

Only write the actual sample count when we know for sure.

CID #1427087
---
 gst/isomp4/qtdemux.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index cadb544ff8..919be3cfbf 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -2675,6 +2675,7 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
   QtDemuxCencSampleSetInfo *ss_info = NULL;
   const gchar *system_id;
   gboolean uses_sub_sample_encryption = FALSE;
+  guint32 sample_count;
 
   if (qtdemux->n_streams == 0)
     return;
@@ -2770,16 +2771,16 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
     uses_sub_sample_encryption = TRUE;
   }
 
-  if (!gst_byte_reader_get_uint32_be (&br, &qtdemux->cenc_aux_sample_count)) {
+  if (!gst_byte_reader_get_uint32_be (&br, &sample_count)) {
     GST_ERROR_OBJECT (qtdemux, "Error getting box's sample count field");
     return;
   }
 
   ss_info->crypto_info =
-      g_ptr_array_new_full (qtdemux->cenc_aux_sample_count,
+      g_ptr_array_new_full (sample_count,
       (GDestroyNotify) qtdemux_gst_structure_free);
 
-  for (i = 0; i < qtdemux->cenc_aux_sample_count; ++i) {
+  for (i = 0; i < sample_count; ++i) {
     GstStructure *properties;
     guint8 *data;
     GstBuffer *buf;
@@ -2787,12 +2788,14 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
     properties = qtdemux_get_cenc_sample_properties (qtdemux, stream, i);
     if (properties == NULL) {
       GST_ERROR_OBJECT (qtdemux, "failed to get properties for sample %u", i);
+      qtdemux->cenc_aux_sample_count = i;
       return;
     }
 
     if (!gst_byte_reader_dup_data (&br, iv_size, &data)) {
       GST_ERROR_OBJECT (qtdemux, "IV data not present for sample %u", i);
       gst_structure_free (properties);
+      qtdemux->cenc_aux_sample_count = i;
       return;
     }
     buf = gst_buffer_new_wrapped (data, iv_size);
@@ -2807,6 +2810,7 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
         GST_ERROR_OBJECT (qtdemux,
             "failed to get subsample count for sample %u", i);
         gst_structure_free (properties);
+        qtdemux->cenc_aux_sample_count = i;
         return;
       }
       GST_LOG_OBJECT (qtdemux, "subsample count: %u", n_subsamples);
@@ -2814,6 +2818,7 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
         GST_ERROR_OBJECT (qtdemux, "failed to get subsample data for sample %u",
             i);
         gst_structure_free (properties);
+        qtdemux->cenc_aux_sample_count = i;
         return;
       }
       buf = gst_buffer_new_wrapped (data, n_subsamples * 6);
@@ -2827,6 +2832,8 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
 
     g_ptr_array_add (ss_info->crypto_info, properties);
   }
+
+  qtdemux->cenc_aux_sample_count = sample_count;
 }
 
 static void