[FFmpeg-cvslog] avformat/cafdec: Check that data chunk end fits within 64bit

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Sat Sep 30 00:45:33 2023 +0200| [d2faf163bbe525dead2ed3bd62cdc7fdc676d108] | committer: Michael Niedermayer

avformat/cafdec: Check that data chunk end fits within 64bit

Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit b792e4d4c772b7b5ef8ea32be187a871000e50c2)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d2faf163bbe525dead2ed3bd62cdc7fdc676d108
---

 libavformat/cafdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index 296e07c085..a33b405f05 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -292,6 +292,9 @@ static int read_header(AVFormatContext *s)
             avio_skip(pb, 4); /* edit count */
             caf->data_start = avio_tell(pb);
             caf->data_size  = size < 0 ? -1 : size - 4;
+            if (caf->data_start < 0 || caf->data_size > INT64_MAX - caf->data_start)
+                return AVERROR_INVALIDDATA;
+
             if (caf->data_size > 0 && (pb->seekable & AVIO_SEEKABLE_NORMAL))
                 avio_skip(pb, caf->data_size);
             found_data = 1;