The box_size_without_header must be positive. Else throw an error

strukturag · Oct 26, 2023 · d85b881 · d85b881
1 parent 0744e74
commit d85b881
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/libheif/box.cc b/libheif/box.cc
@@ -657,7 +657,7 @@ Error Box::read(BitstreamRange& range, std::shared_ptr<Box>* result)
 
   // Box size may not be larger than remaining bytes in parent box.
 
-  if ((int64_t)range.get_remaining_bytes() < box_size_without_header) {
+  if ((int64_t)range.get_remaining_bytes() < box_size_without_header || box_size_without_header < 0) {
     return Error(heif_error_Invalid_input,
                  heif_suberror_Invalid_box_size);
   }