Fix several overflows in box and track processing

src/mp4box/avc1.rs

@@ -103,6 +103,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for Avc1Box {
 
         let header = BoxHeader::read(reader)?;
         let BoxHeader { name, size: s } = header;
+        if s > size {
+            return Err(Error::InvalidData(
+                "avc1 box contains a box with a larger size than it",
+            ));
+        }
         if name == BoxType::AvcCBox {
             let avcc = AvcCBox::read_box(reader, s)?;
 

src/mp4box/co64.rs

@@ -1,6 +1,7 @@
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
 use serde::Serialize;
 use std::io::{Read, Seek, Write};
+use std::mem::size_of;
 
 use crate::mp4box::*;
 
@@ -48,7 +49,20 @@ impl<R: Read + Seek> ReadBox<&mut R> for Co64Box {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
+        let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
+        let other_size = size_of::<u32>(); // entry_count
+        let entry_size = size_of::<u64>(); // chunk_offset
         let entry_count = reader.read_u32::<BigEndian>()?;
+        if u64::from(entry_count)
+            > size
+                .saturating_sub(header_size)
+                .saturating_sub(other_size as u64)
+                / entry_size as u64
+        {
+            return Err(Error::InvalidData(
+                "co64 entry_count indicates more entries than could fit in the box",
+            ));
+        }
         let mut entries = Vec::with_capacity(entry_count as usize);
         for _i in 0..entry_count {
             let chunk_offset = reader.read_u64::<BigEndian>()?;

src/mp4box/ctts.rs

@@ -1,6 +1,7 @@
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
 use serde::Serialize;
 use std::io::{Read, Seek, Write};
+use std::mem::size_of;
 
 use crate::mp4box::*;
 
@@ -54,7 +55,21 @@ impl<R: Read + Seek> ReadBox<&mut R> for CttsBox {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
+        let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
         let entry_count = reader.read_u32::<BigEndian>()?;
+        let entry_size = size_of::<u32>() + size_of::<i32>(); // sample_count + sample_offset
+                                                              // (sample_offset might be a u32, but the size is the same.)
+        let other_size = size_of::<i32>(); // entry_count
+        if u64::from(entry_count)
+            > size
+                .saturating_sub(header_size)
+                .saturating_sub(other_size as u64)
+                / entry_size as u64
+        {
+            return Err(Error::InvalidData(
+                "ctts entry_count indicates more entries than could fit in the box",
+            ));
+        }
         let mut entries = Vec::with_capacity(entry_count as usize);
         for _ in 0..entry_count {
             let entry = CttsEntry {

src/mp4box/dinf.rs

@@ -49,6 +49,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for DinfBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "dinf box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::DrefBox => {
@@ -156,6 +161,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for DrefBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "dinf box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::UrlBox => {
@@ -254,7 +264,7 @@ impl<R: Read + Seek> ReadBox<&mut R> for UrlBox {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
-        let location = if size - HEADER_SIZE - HEADER_EXT_SIZE > 0 {
+        let location = if size.saturating_sub(HEADER_SIZE + HEADER_EXT_SIZE) > 0 {
             let buf_size = size - HEADER_SIZE - HEADER_EXT_SIZE - 1;
             let mut buf = vec![0u8; buf_size as usize];
             reader.read_exact(&mut buf)?;

src/mp4box/edts.rs

@@ -54,6 +54,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for EdtsBox {
 
         let header = BoxHeader::read(reader)?;
         let BoxHeader { name, size: s } = header;
+        if s > size {
+            return Err(Error::InvalidData(
+                "edts box contains a box with a larger size than it",
+            ));
+        }
 
         if let BoxType::ElstBox = name {
             let elst = ElstBox::read_box(reader, s)?;

src/mp4box/elst.rs

@@ -1,6 +1,7 @@
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
 use serde::Serialize;
 use std::io::{Read, Seek, Write};
+use std::mem::size_of;
 
 use crate::mp4box::*;
 
@@ -62,7 +63,29 @@ impl<R: Read + Seek> ReadBox<&mut R> for ElstBox {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
+        let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
         let entry_count = reader.read_u32::<BigEndian>()?;
+        let other_size = size_of::<i32>(); // entry_count
+        let entry_size = {
+            let mut entry_size = 0;
+            entry_size += if version == 1 {
+                size_of::<u64>() + size_of::<i64>() // segment_duration + media_time
+            } else {
+                size_of::<u32>() + size_of::<i32>() // segment_duration + media_time
+            };
+            entry_size += size_of::<i16>() + size_of::<i16>(); // media_rate_integer + media_rate_fraction
+            entry_size
+        };
+        if u64::from(entry_count)
+            > size
+                .saturating_sub(header_size)
+                .saturating_sub(other_size as u64)
+                / entry_size as u64
+        {
+            return Err(Error::InvalidData(
+                "elst entry_count indicates more entries than could fit in the box",
+            ));
+        }
         let mut entries = Vec::with_capacity(entry_count as usize);
         for _ in 0..entry_count {
             let (segment_duration, media_time) = if version == 1 {

src/mp4box/ftyp.rs

@@ -53,12 +53,12 @@ impl<R: Read + Seek> ReadBox<&mut R> for FtypBox {
     fn read_box(reader: &mut R, size: u64) -> Result<Self> {
         let start = box_start(reader)?;
 
-        let major = reader.read_u32::<BigEndian>()?;
-        let minor = reader.read_u32::<BigEndian>()?;
-        if size % 4 != 0 {
-            return Err(Error::InvalidData("invalid ftyp size"));
+        if size < 16 || size % 4 != 0 {
+            return Err(Error::InvalidData("ftyp size too small or not aligned"));
         }
         let brand_count = (size - 16) / 4; // header + major + minor
+        let major = reader.read_u32::<BigEndian>()?;
+        let minor = reader.read_u32::<BigEndian>()?;
 
         let mut brands = Vec::new();
         for _ in 0..brand_count {

src/mp4box/hdlr.rs

@@ -52,7 +52,9 @@ impl<R: Read + Seek> ReadBox<&mut R> for HdlrBox {
 
         skip_bytes(reader, 12)?; // reserved
 
-        let buf_size = size - HEADER_SIZE - HEADER_EXT_SIZE - 20 - 1;
+        let buf_size = size
+            .checked_sub(HEADER_SIZE + HEADER_EXT_SIZE + 20 + 1)
+            .ok_or(Error::InvalidData("hdlr size too small"))?;
         let mut buf = vec![0u8; buf_size as usize];
         reader.read_exact(&mut buf)?;
 

src/mp4box/hev1.rs

@@ -103,6 +103,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for Hev1Box {
 
         let header = BoxHeader::read(reader)?;
         let BoxHeader { name, size: s } = header;
+        if s > size {
+            return Err(Error::InvalidData(
+                "hev1 box contains a box with a larger size than it",
+            ));
+        }
         if name == BoxType::HvcCBox {
             let hvcc = HvcCBox::read_box(reader, s)?;
 

src/mp4box/ilst.rs

@@ -25,6 +25,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for IlstBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "ilst box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::NameBox => {
@@ -71,6 +76,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for IlstItemBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "ilst item box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::DataBox => {

src/mp4box/mdia.rs

@@ -54,6 +54,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MdiaBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "mdia box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::MdhdBox => {

src/mp4box/meta.rs

@@ -28,6 +28,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MetaBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "meta box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::IlstBox => {

src/mp4box/minf.rs

@@ -69,6 +69,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MinfBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "minf box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::VmhdBox => {

src/mp4box/moof.rs

@@ -58,6 +58,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MoofBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "moof box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::MfhdBox => {

src/mp4box/moov.rs

@@ -66,6 +66,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MoovBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "moov box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::MvhdBox => {

src/mp4box/mp4a.rs

@@ -94,6 +94,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for Mp4aBox {
         if current < start + size {
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "mp4a box contains a box with a larger size than it",
+                ));
+            }
 
             if name == BoxType::EsdsBox {
                 esds = Some(EsdsBox::read_box(reader, s)?);

src/mp4box/mvex.rs

@@ -52,6 +52,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for MvexBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "mvex box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::MehdBox => {

src/mp4box/stbl.rs

@@ -92,6 +92,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for StblBox {
             // Get box header.
             let header = BoxHeader::read(reader)?;
             let BoxHeader { name, size: s } = header;
+            if s > size {
+                return Err(Error::InvalidData(
+                    "stbl box contains a box with a larger size than it",
+                ));
+            }
 
             match name {
                 BoxType::StsdBox => {

src/mp4box/stco.rs

@@ -1,6 +1,7 @@
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
 use serde::Serialize;
 use std::io::{Read, Seek, Write};
+use std::mem::size_of;
 
 use crate::mp4box::*;
 
@@ -48,7 +49,20 @@ impl<R: Read + Seek> ReadBox<&mut R> for StcoBox {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
+        let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
+        let other_size = size_of::<u32>(); // entry_count
+        let entry_size = size_of::<u32>(); // chunk_offset
         let entry_count = reader.read_u32::<BigEndian>()?;
+        if u64::from(entry_count)
+            > size
+                .saturating_sub(header_size)
+                .saturating_sub(other_size as u64)
+                / entry_size as u64
+        {
+            return Err(Error::InvalidData(
+                "stco entry_count indicates more entries than could fit in the box",
+            ));
+        }
         let mut entries = Vec::with_capacity(entry_count as usize);
         for _i in 0..entry_count {
             let chunk_offset = reader.read_u32::<BigEndian>()?;

src/mp4box/stsc.rs

@@ -1,6 +1,7 @@
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
 use serde::Serialize;
 use std::io::{Read, Seek, Write};
+use std::mem::size_of;
 
 use crate::mp4box::*;
 
@@ -56,7 +57,20 @@ impl<R: Read + Seek> ReadBox<&mut R> for StscBox {
 
         let (version, flags) = read_box_header_ext(reader)?;
 
+        let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
+        let other_size = size_of::<u32>(); // entry_count
+        let entry_size = size_of::<u32>() + size_of::<u32>() + size_of::<u32>(); // first_chunk + samples_per_chunk + sample_description_index
         let entry_count = reader.read_u32::<BigEndian>()?;
+        if u64::from(entry_count)
+            > size
+                .saturating_sub(header_size)
+                .saturating_sub(other_size as u64)
+                / entry_size as u64
+        {
+            return Err(Error::InvalidData(
+                "stsc entry_count indicates more entries than could fit in the box",
+            ));
+        }
         let mut entries = Vec::with_capacity(entry_count as usize);
         for _ in 0..entry_count {
             let entry = StscEntry {
@@ -77,7 +91,14 @@ impl<R: Read + Seek> ReadBox<&mut R> for StscBox {
             };
             if i < entry_count - 1 {
                 let next_entry = entries.get(i as usize + 1).unwrap();
-                sample_id += (next_entry.first_chunk - first_chunk) * samples_per_chunk;
+                sample_id = next_entry
+                    .first_chunk
+                    .checked_sub(first_chunk)
+                    .and_then(|n| n.checked_mul(samples_per_chunk))
+                    .and_then(|n| n.checked_add(sample_id))
+                    .ok_or(Error::InvalidData(
+                        "attempt to calculate stsc sample_id with overflow",
+                    ))?;
             }
         }
 

src/mp4box/stsd.rs

@@ -85,6 +85,11 @@ impl<R: Read + Seek> ReadBox<&mut R> for StsdBox {
         // Get box header.
         let header = BoxHeader::read(reader)?;
         let BoxHeader { name, size: s } = header;
+        if s > size {
+            return Err(Error::InvalidData(
+                "stsd box contains a box with a larger size than it",
+            ));
+        }
 
         match name {
             BoxType::Avc1Box => {