@@ -5045,15 +5045,18 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!c->meta_keys)
return AVERROR(ENOMEM);
+ uint32_t bytes_left_in_atom = atom.size;
for (i = 1; i <= count; ++i) {
uint32_t key_size = avio_rb32(pb);
uint32_t type = avio_rl32(pb);
- if (key_size < 8) {
+ if (key_size < 8 || key_size > bytes_left_in_atom) {
av_log(c->fc, AV_LOG_ERROR,
"The key# %"PRIu32" in meta has invalid size:"
"%"PRIu32"\n", i, key_size);
return AVERROR_INVALIDDATA;
}
+
+ bytes_left_in_atom -= key_size;
key_size -= 8;
if (type != MKTAG('m','d','t','a')) {
avio_skip(pb, key_size);