[FFmpeg-cvslog] avformat/mov: check extent_offset calculation for overflow

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Sun Jun 30 23:40:20 2024 -0300| [a9a5d000aa14fc1caa535de4649a67e5a209435d] | committer: James Almer

avformat/mov: check extent_offset calculation for overflow

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a9a5d000aa14fc1caa535de4649a67e5a209435d
---

 libavformat/mov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index d31fb23f27..e8b7420fc7 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8456,7 +8456,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         }
         for (int j = 0; j < extent_count; j++) {
             if (rb_size(pb, &extent_offset, offset_size) < 0 ||
-                rb_size(pb, &extent_length, length_size) < 0)
+                rb_size(pb, &extent_length, length_size) < 0 ||
+                base_offset > INT64_MAX - extent_offset)
                 return AVERROR_INVALIDDATA;
             if (offset_type == 1)
                 c->heif_item[i].is_idat_relative = 1;