[FFmpeg-devel] [PATCH 2/4] avformat/mov: check extent_offset calculation for overflow

[James Almer]

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavformat/mov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index fd78d5f59c..3aa2398386 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8482,7 +8482,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         }
         for (int j = 0; j < extent_count; j++) {
             if (rb_size(pb, &extent_offset, offset_size) < 0 ||
-                rb_size(pb, &extent_length, length_size) < 0)
+                rb_size(pb, &extent_length, length_size) < 0 ||
+                base_offset > INT64_MAX - extent_offset)
                 return AVERROR_INVALIDDATA;
             if (offset_type == 1)
                 c->heif_item[i].is_idat_relative = 1;
-- 
2.45.2