[FFmpeg-cvslog] avformat/mov: add more checks for infe atom size

[James Almer]

ffmpeg | branch: release/7.0 | James Almer <jamrial at gmail.com> | Sun Jun 30 23:40:22 2024 -0300| [28b1dbb4ee23e471bb1f8e6e6e6a46ce59a2dcce] | committer: James Almer

avformat/mov: add more checks for infe atom size

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=28b1dbb4ee23e471bb1f8e6e6e6a46ce59a2dcce
---

 libavformat/mov.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2c47610d0e..be8add7603 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8132,6 +8132,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
     version = avio_r8(pb);
     avio_rb24(pb);  // flags.
     size -= 4;
+    if (size < 0)
+        return AVERROR_INVALIDDATA;
 
     if (version < 2) {
         avpriv_report_missing_feature(c->fc, "infe version < 2");
@@ -8143,6 +8145,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
     avio_rb16(pb); // item_protection_index
     item_type = avio_rl32(pb);
     size -= 8;
+    if (size < 1)
+        return AVERROR_INVALIDDATA;
 
     av_bprint_init(&item_name, 0, AV_BPRINT_SIZE_UNLIMITED);
     ret = ff_read_string_to_bprint_overwrite(pb, &item_name, size);