[FFmpeg-devel] [PATCH 1/4] avformat/mov: check that iloc offset values fit on an int64_t

[James Almer]

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavformat/mov.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index a2e187ff2f..fd78d5f59c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8388,7 +8388,7 @@ static int mov_read_SAND(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     return 0;
 }
 
-static int rb_size(AVIOContext *pb, uint64_t* value, int size)
+static int rb_size(AVIOContext *pb, int64_t *value, int size)
 {
     if (size == 0)
         *value = 0;
@@ -8398,9 +8398,11 @@ static int rb_size(AVIOContext *pb, uint64_t* value, int size)
         *value = avio_rb16(pb);
     else if (size == 4)
         *value = avio_rb32(pb);
-    else if (size == 8)
+    else if (size == 8) {
         *value = avio_rb64(pb);
-    else
+        if (*value < 0)
+            return -1;
+    } else
         return -1;
     return size;
 }
-- 
2.45.2