[FFmpeg-cvslog] avformat/mov: check that iloc offset values fit on an int64_t

[James Almer]

ffmpeg | branch: release/7.0 | James Almer <jamrial at gmail.com> | Sun Jun 30 23:40:19 2024 -0300| [b44758d8e43595b7505034ed347f7448f53547c6] | committer: James Almer

avformat/mov: check that iloc offset values fit on an int64_t

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b44758d8e43595b7505034ed347f7448f53547c6
---

 libavformat/mov.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index c2538a9681..a64b89b821 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8010,7 +8010,7 @@ static int mov_read_SAND(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     return 0;
 }
 
-static int rb_size(AVIOContext *pb, uint64_t* value, int size)
+static int rb_size(AVIOContext *pb, int64_t *value, int size)
 {
     if (size == 0)
         *value = 0;
@@ -8020,9 +8020,11 @@ static int rb_size(AVIOContext *pb, uint64_t* value, int size)
         *value = avio_rb16(pb);
     else if (size == 4)
         *value = avio_rb32(pb);
-    else if (size == 8)
+    else if (size == 8) {
         *value = avio_rb64(pb);
-    else
+        if (*value < 0)
+            return -1;
+    } else
         return -1;
     return size;
 }