[FFmpeg-cvslog] avformat/mov: Check if a key is longer than the atom containing it

[Eugene Zemtsov]

ffmpeg | branch: release/7.0 | Eugene Zemtsov <eugene at chromium.org> | Mon Apr  1 19:28:03 2024 -0700| [d0e5f83ffb30b6110b14d35faf2bec060c61a8af] | committer: James Almer

avformat/mov: Check if a key is longer than the atom containing it

Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.

Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene at chromium.org>
Signed-off-by: James Almer <jamrial at gmail.com>
(cherry picked from commit 8a23a145d85964950123952d897b89c2c2b1b8c5)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d0e5f83ffb30b6110b14d35faf2bec060c61a8af
---

 libavformat/mov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 917a69fa34..be4291c0da 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5037,12 +5037,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     for (i = 1; i <= count; ++i) {
         uint32_t key_size = avio_rb32(pb);
         uint32_t type = avio_rl32(pb);
-        if (key_size < 8) {
+        if (key_size < 8 || key_size > atom.size) {
             av_log(c->fc, AV_LOG_ERROR,
                    "The key# %"PRIu32" in meta has invalid size:"
                    "%"PRIu32"\n", i, key_size);
             return AVERROR_INVALIDDATA;
         }
+        atom.size -= key_size;
         key_size -= 8;
         if (type != MKTAG('m','d','t','a')) {
             avio_skip(pb, key_size);