[FFmpeg-cvslog] avformat/mov: check that iloc offset values fit on an int64_t

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Sun Jun 30 23:40:19 2024 -0300| [c49898a6b15a11a953620c588422c004cb826d15] | committer: James Almer

avformat/mov: check that iloc offset values fit on an int64_t

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c49898a6b15a11a953620c588422c004cb826d15
---

 libavformat/mov.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index a3951a6942..d31fb23f27 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8362,7 +8362,7 @@ static int mov_read_SAND(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     return 0;
 }
 
-static int rb_size(AVIOContext *pb, uint64_t* value, int size)
+static int rb_size(AVIOContext *pb, int64_t *value, int size)
 {
     if (size == 0)
         *value = 0;
@@ -8372,9 +8372,11 @@ static int rb_size(AVIOContext *pb, uint64_t* value, int size)
         *value = avio_rb16(pb);
     else if (size == 4)
         *value = avio_rb32(pb);
-    else if (size == 8)
+    else if (size == 8) {
         *value = avio_rb64(pb);
-    else
+        if (*value < 0)
+            return -1;
+    } else
         return -1;
     return size;
 }