Merge branch 'mp4v2-2.1.x'

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.0)
 
-project(MP4v2 VERSION 2.1.2)
+project(MP4v2 VERSION 2.1.3)
 
 set(CMAKE_CXX_STANDARD 11)
 

doc/texi/ReleaseNotes.texi

@@ -13,12 +13,35 @@
 @contents
 
 @chapter What's New?
+
+@unnumberedsec MP4v2 v2.1.3
+
+Version 2.1.3 fixes several stability issues, including the following CVEs:
+
+  @itemize @minus
+  @item
+    https://nvd.nist.gov/vuln/detail/CVE-2023-29584
+  @item
+    https://nvd.nist.gov/vuln/detail/CVE-2023-1451
+  @item
+    https://nvd.nist.gov/vuln/detail/CVE-2023-1450
+  @end itemize
+
+The 2.1.3 update also fixes a performance issue when operating on files with unusually large chunks (containing thousands or
+even millions of samples instead of the usual few dozen).
+
+@unnumberedsec MP4v2 v2.1.2
+
 Version 2.1.2 fixes build system issues, mainly in the CMake build system support. This release also fixes a file seeking
 issue observed on Windows when compiled with _WIN32_WINNT < 0x600 and linked against modern CRT DLLs. In addition, two minor
 issues related to data handling are fixed.
 
+@unnumberedsec MP4v2 v2.1.1
+
 Version 2.1.1 fixes a type mismatch preventing MP4v2 from compiling on 32 bit systems.
 
+@unnumberedsec MP4v2 v2.1
+
 Version 2.1 updates the existing build systems and adds support for building with CMake and Xcode. It also fixes compilation
 with newer compilers and integrates smaller improvements and bug fixes from various MP4v2 forks.
 

project/project.m4sugar

@@ -12,5 +12,5 @@ define([PRJ_url_bugreport],  [https://github.com/enzo1982/issues])
 define([PRJ_support],        [[email protected]])
 define([PRJ_version_major],  [2])
 define([PRJ_version_minor],  [1])
-define([PRJ_version_point],  [2])
+define([PRJ_version_point],  [3])
 define([PRJ_repo_url],       [[email protected]:enzo1982/mp4v2.git])

src/atom_rtp.cpp

@@ -125,12 +125,19 @@ void MP4RtpAtom::ReadHntiType()
 
     // read sdp string, length is implicit in size of atom
     uint64_t size = GetEnd() - m_File.GetPosition();
-    char* data = (char*)MP4Malloc(size + 1);
+    char* data = (char*) MP4Malloc(size + 1);
     ASSERT(data != NULL);
-    m_File.ReadBytes((uint8_t*)data, size);
-    data[size] = '\0';
-    ((MP4StringProperty*)m_pProperties[1])->SetValue(data);
-    MP4Free(data);
+    try {
+        m_File.ReadBytes((uint8_t*) data, size);
+        data[size] = '\0';
+        ((MP4StringProperty*) m_pProperties[1])->SetValue(data);
+        MP4Free(data);
+    }
+    catch (Exception*) {
+        // free memory and rethrow
+        MP4Free(data);
+        throw;
+    }
 }
 
 void MP4RtpAtom::Write()

src/atom_sdp.cpp

@@ -36,12 +36,19 @@ void MP4SdpAtom::Read()
 {
     // read sdp string, length is implicit in size of atom
     uint64_t size = GetEnd() - m_File.GetPosition();
-    char* data = (char*)MP4Malloc(size + 1);
+    char* data = (char*) MP4Malloc(size + 1);
     ASSERT(data != NULL);
-    m_File.ReadBytes((uint8_t*)data, size);
-    data[size] = '\0';
-    ((MP4StringProperty*)m_pProperties[0])->SetValue(data);
-    MP4Free(data);
+    try {
+        m_File.ReadBytes((uint8_t*) data, size);
+        data[size] = '\0';
+        ((MP4StringProperty*) m_pProperties[0])->SetValue(data);
+        MP4Free(data);
+    }
+    catch (Exception*) {
+        // free memory and rethrow
+        MP4Free(data);
+        throw;
+    }
 }
 
 void MP4SdpAtom::Write()

src/mp4file_io.cpp

@@ -347,19 +347,26 @@ char* MP4File::ReadString()
 {
     uint32_t length = 0;
     uint32_t alloced = 64;
-    char* data = (char*)MP4Malloc(alloced);
-
-    do {
-        if (length == alloced) {
-            data = (char*)MP4Realloc(data, alloced * 2);
-            if (data == NULL) return NULL;
-            alloced *= 2;
-        }
-        ReadBytes((uint8_t*)&data[length], 1);
-        length++;
-    } while (data[length - 1] != 0);
-
-    data = (char*)MP4Realloc(data, length);
+    char* data = (char*) MP4Malloc(alloced);
+    try {
+        do {
+            if (length == alloced) {
+                data = (char*) MP4Realloc(data, alloced * 2);
+                if (data == NULL)
+                    return NULL;
+                alloced *= 2;
+            }
+            ReadBytes((uint8_t*) &data[length], 1);
+            length++;
+        } while (data[length - 1] != 0);
+
+        data = (char*) MP4Realloc(data, length);
+    }
+    catch (Exception*) {
+        // free memory and rethrow
+        MP4Free(data);
+        throw;
+    }
     return data;
 }
 
@@ -406,21 +413,34 @@ char* MP4File::ReadCountedString(uint8_t charSize, bool allowExpandedCount, uint
     }
 
     uint32_t byteLength = charLength * charSize;
-    char* data = (char*)MP4Malloc(byteLength + 1);
-    if (byteLength > 0) {
-        ReadBytes((uint8_t*)data, byteLength);
-    }
-    data[byteLength] = '\0';
-
-    // read padding
-    if (fixedLength) {
-        const uint8_t padsize = fixedLength - byteLength -1U;
-        if( padsize ) {
-            uint8_t* padbuf = (uint8_t*)malloc( padsize );
-            ReadBytes( padbuf, padsize );
-            free( padbuf );
+    char* data = (char*) MP4Malloc(byteLength + 1);
+    try {
+        if (byteLength > 0)
+            ReadBytes((uint8_t*) data, byteLength);
+        data[byteLength] = '\0';
+
+        // read padding
+        if (fixedLength) {
+            const uint8_t padsize = fixedLength - byteLength -1U;
+            if (padsize) {
+                uint8_t* padbuf = (uint8_t*) MP4Malloc(padsize);
+                try {
+                    ReadBytes(padbuf, padsize);
+                    MP4Free(padbuf);
+                }
+                catch (Exception*) {
+                    // free memory and rethrow
+                    MP4Free(padbuf);
+                    throw;
+                }
+            }
         }
     }
+    catch (Exception*) {
+        // free memory and rethrow
+        MP4Free(data);
+        throw;
+    }
 
     return data;
 }

src/mp4property.cpp

@@ -379,6 +379,10 @@ void MP4StringProperty::SetCount(uint32_t count)
 {
     uint32_t oldCount = m_values.Size();
 
+    for (uint32_t i = count; i < oldCount; i++) {
+        MP4Free(m_values[i]);
+    }
+
     m_values.Resize(count);
 
     for (uint32_t i = oldCount; i < count; i++) {
@@ -546,6 +550,10 @@ void MP4BytesProperty::SetCount(uint32_t count)
 {
     uint32_t oldCount = m_values.Size();
 
+    for (uint32_t i = count; i < oldCount; i++) {
+        MP4Free(m_values[i]);
+    }
+
     m_values.Resize(count);
     m_valueSizes.Resize(count);
 

vstudio/include/mp4v2/project.h

@@ -6,19 +6,19 @@
 #define MP4V2_PROJECT_name            "MP4v2"
 #define MP4V2_PROJECT_name_lower      "mp4v2"
 #define MP4V2_PROJECT_name_upper      "MP4V2"
-#define MP4V2_PROJECT_name_formal     "MP4v2 2.1.2"
+#define MP4V2_PROJECT_name_formal     "MP4v2 2.1.3"
 #define MP4V2_PROJECT_url_website     "https://mp4v2.org"
 #define MP4V2_PROJECT_url_downloads   "https://github.com/enzo1982/releases"
 #define MP4V2_PROJECT_url_discussion  "https://github.com/enzo1982/discussions"
 #define MP4V2_PROJECT_url_bugreport   "https://github.com/enzo1982/issues"
 #define MP4V2_PROJECT_support         "<[email protected]>"
-#define MP4V2_PROJECT_version         "2.1.2"
-#define MP4V2_PROJECT_version_hex     0x00020102
+#define MP4V2_PROJECT_version         "2.1.3"
+#define MP4V2_PROJECT_version_hex     0x00020103
 #define MP4V2_PROJECT_version_major   2
 #define MP4V2_PROJECT_version_minor   1
-#define MP4V2_PROJECT_version_point   2
+#define MP4V2_PROJECT_version_point   3
 #define MP4V2_PROJECT_repo_url        "[email protected]:enzo1982/mp4v2.git"
-#define MP4V2_PROJECT_build           "Thu Feb 09 23:15:44 UTC 2023"
+#define MP4V2_PROJECT_build           "Wed May 10 22:42:12 UTC 2023"
 
 /*****************************************************************************/
 

xcode/include/libplatform/config.h

@@ -49,7 +49,7 @@
 #define PACKAGE_NAME "MP4v2"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "MP4v2 2.1.2"
+#define PACKAGE_STRING "MP4v2 2.1.3"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "mp4v2"
@@ -58,12 +58,12 @@
 #define PACKAGE_URL "https://mp4v2.org"
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.1.2"
+#define PACKAGE_VERSION "2.1.3"
 
 /* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #define STDC_HEADERS 1
 
 /* Version number of package */
-#define VERSION "2.1.2"
+#define VERSION "2.1.3"

xcode/include/mp4v2/project.h

@@ -6,19 +6,19 @@
 #define MP4V2_PROJECT_name            "MP4v2"
 #define MP4V2_PROJECT_name_lower      "mp4v2"
 #define MP4V2_PROJECT_name_upper      "MP4V2"
-#define MP4V2_PROJECT_name_formal     "MP4v2 2.1.2"
+#define MP4V2_PROJECT_name_formal     "MP4v2 2.1.3"
 #define MP4V2_PROJECT_url_website     "https://mp4v2.org"
 #define MP4V2_PROJECT_url_downloads   "https://github.com/enzo1982/releases"
 #define MP4V2_PROJECT_url_discussion  "https://github.com/enzo1982/discussions"
 #define MP4V2_PROJECT_url_bugreport   "https://github.com/enzo1982/issues"
 #define MP4V2_PROJECT_support         "<[email protected]>"
-#define MP4V2_PROJECT_version         "2.1.2"
-#define MP4V2_PROJECT_version_hex     0x00020102
+#define MP4V2_PROJECT_version         "2.1.3"
+#define MP4V2_PROJECT_version_hex     0x00020103
 #define MP4V2_PROJECT_version_major   2
 #define MP4V2_PROJECT_version_minor   1
-#define MP4V2_PROJECT_version_point   2
+#define MP4V2_PROJECT_version_point   3
 #define MP4V2_PROJECT_repo_url        "[email protected]:enzo1982/mp4v2.git"
-#define MP4V2_PROJECT_build           "Thu Feb 09 23:15:44 UTC 2023"
+#define MP4V2_PROJECT_build           "Wed May 10 22:42:12 UTC 2023"
 
 /*****************************************************************************/