o Fixed a bug in the index reader that allowed an out-of-bounds vector index to be used

o Modified the IndexEntry parser to ignore additional bytes belonging to slice values

4 files changed, 66 insertions, 11 deletions

diff --git a/src/Index.cpp b/src/Index.cpp
index f996339..6406e0f 100755
--- a/src/Index.cpp
+++ b/src/Index.cpp
@@ -79,7 +79,42 @@ ASDCP::MXF::IndexTableSegment::InitFromTLVSet(TLVReader& TLVSet)
   if ( ASDCP_SUCCESS(result) ) result = TLVSet.ReadUi8(OBJ_READ_ARGS(IndexTableSegmentBase, SliceCount));
   if ( ASDCP_SUCCESS(result) ) result = TLVSet.ReadUi8(OBJ_READ_ARGS(IndexTableSegmentBase, PosTableCount));
   if ( ASDCP_SUCCESS(result) ) result = TLVSet.ReadObject(OBJ_READ_ARGS(IndexTableSegment, DeltaEntryArray));
-  if ( ASDCP_SUCCESS(result) ) result = TLVSet.ReadObject(OBJ_READ_ARGS(IndexTableSegment, IndexEntryArray));
+
+  if ( ASDCP_SUCCESS(result) )
+    {
+      bool rc = TLVSet.FindTL(m_Dict->Type(MDD_IndexTableSegment_IndexEntryArray));
+
+      if ( rc )
+	{
+	  ui32_t item_count, item_size;
+	  ui32_t const decoder_item_size = IndexEntryArray.ItemSize();
+
+	  if ( TLVSet.ReadUi32BE(&item_count) )
+	    {
+	      if ( TLVSet.ReadUi32BE(&item_size) )
+		{
+		  for ( ui32_t i = 0; i < item_count && rc; ++i )
+		    {
+		      IndexEntry tmp_item;
+		      rc = tmp_item.Unarchive(&TLVSet);
+
+		      if ( rc )
+			{
+			  IndexEntryArray.push_back(tmp_item);
+
+			  if ( decoder_item_size < item_size )
+			    {
+			      TLVSet.SkipOffset(item_size - decoder_item_size);
+			    }
+			}
+		    }
+		}
+	    }
+	}
+
+      result = rc ? RESULT_OK : RESULT_FALSE;
+    }
+
   return result;
 }
 
@@ -136,7 +171,11 @@ ASDCP::MXF::IndexTableSegment::Dump(FILE* stream)
 
   fprintf(stream, "  DeltaEntryArray:\n");  DeltaEntryArray.Dump(stream);
 
-  if ( IndexEntryArray.size() < 1000 )
+  if ( IndexEntryArray.empty() )
+    {
+      fprintf(stream, "  IndexEntryArray: NO ENTRIES\n");
+    }
+  else if ( IndexEntryArray.size() < 1000 )
     {
       fprintf(stream, "  IndexEntryArray:\n");
       IndexEntryArray.Dump(stream);
diff --git a/src/MXF.cpp b/src/MXF.cpp
index 92ae5bb..45b0298 100755
--- a/src/MXF.cpp
+++ b/src/MXF.cpp
@@ -1216,8 +1216,16 @@ ASDCP::MXF::OPAtomIndexFooter::Lookup(ui32_t frame_num, IndexTableSegment::Index
 	    {
 	      ui64_t tmp = frame_num - start_pos;
 	      assert(tmp <= 0xFFFFFFFFL);
-	      Entry = segment->IndexEntryArray[(ui32_t) tmp];
-	      return RESULT_OK;
+
+	      if ( tmp < segment->IndexEntryArray.size() )
+		{
+		  Entry = segment->IndexEntryArray[(ui32_t) tmp];
+		  return RESULT_OK;
+		}
+	      else
+		{
+		  DefaultLogSink().Error("Malformed index table segment, IndexDuration does not match entries.\n");
+		}
 	    }
 	}
     }
diff --git a/src/MXFTypes.h b/src/MXFTypes.h
index f74f4f5..3bfa03d 100755
--- a/src/MXFTypes.h
+++ b/src/MXFTypes.h
@@ -65,10 +65,10 @@ namespace ASDCP
 
 	  TLVReader();
 	  ASDCP_NO_COPY_CONSTRUCT(TLVReader);
-	  bool FindTL(const MDDEntry&);
 
 	public:
 	  TLVReader(const byte_t* p, ui32_t c, IPrimerLookup* = 0);
+	  bool FindTL(const MDDEntry&);
 	  Result_t ReadObject(const MDDEntry&, Kumu::IArchive*);
 	  Result_t ReadUi8(const MDDEntry&, ui8_t*);
 	  Result_t ReadUi16(const MDDEntry&, ui16_t*);
diff --git a/src/h__02_Reader.cpp b/src/h__02_Reader.cpp
index d852592..9e07f72 100644
--- a/src/h__02_Reader.cpp
+++ b/src/h__02_Reader.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2015, Robert Scheler, Heiko Sparenberg Fraunhofer IIS,
+Copyright (c) 2011-2016, Robert Scheler, Heiko Sparenberg Fraunhofer IIS,
 John Hurst
 
 All rights reserved.
@@ -353,7 +353,7 @@ AS_02::MXF::AS02IndexReader::Lookup(ui32_t frame_num, ASDCP::MXF::IndexTableSegm
 	{
 	  ui64_t start_pos = segment->IndexStartPosition;
 
-	  if ( segment->EditUnitByteCount > 0 )
+	  if ( segment->EditUnitByteCount > 0 ) // CBR
 	    {
 	      if ( m_PacketList->m_List.size() > 1 )
 		DefaultLogSink().Error("Unexpected multiple IndexTableSegment in CBR file\n");
@@ -365,13 +365,21 @@ AS_02::MXF::AS02IndexReader::Lookup(ui32_t frame_num, ASDCP::MXF::IndexTableSegm
 	      return RESULT_OK;
 	    }
 	  else if ( (ui64_t)frame_num >= start_pos
-		    && (ui64_t)frame_num < (start_pos + segment->IndexDuration) )
+		    && (ui64_t)frame_num < (start_pos + segment->IndexDuration) ) // VBR in segments
 	    {
 	      ui64_t tmp = frame_num - start_pos;
 	      assert(tmp <= 0xFFFFFFFFL);
-	      Entry = segment->IndexEntryArray[(ui32_t) tmp];
-	      Entry.StreamOffset = Entry.StreamOffset - segment->RtEntryOffset + segment->RtFileOffset;
-	      return RESULT_OK;
+
+	      if ( tmp < segment->IndexEntryArray.size() )
+		{
+		  Entry = segment->IndexEntryArray[(ui32_t) tmp];
+		  Entry.StreamOffset = Entry.StreamOffset - segment->RtEntryOffset + segment->RtFileOffset;
+		  return RESULT_OK;
+		}
+	      else
+		{
+		  DefaultLogSink().Error("Malformed index table segment, IndexDuration does not match entries.\n");
+		}
 	    }
 	}
     }