Merge pull request #312 from mozilla/ossfuzz-35486

Gracefully fail when the number of bytes a ctts box reports overflows `u32`

Author: baumanj

mp4parse/src/lib.rs

@@ -3439,11 +3439,9 @@ fn read_ctts<T: Read>(src: &mut BMFFBox<T>) -> Result<CompositionOffsetBox> {
 
     let counts = be_u32(src)?;
 
-    if src.bytes_left()
-        < counts
-            .checked_mul(8)
-            .expect("counts -> bytes overflow")
-            .into()
+    if counts
+        .checked_mul(8)
+        .map_or(true, |bytes| u64::from(bytes) > src.bytes_left())
     {
         return Err(Error::InvalidData("insufficient data in 'ctts' box"));
     }
@@ -3469,7 +3467,7 @@ fn read_ctts<T: Read>(src: &mut BMFFBox<T>) -> Result<CompositionOffsetBox> {
         })?;
     }
 
-    skip_box_remain(src)?;
+    check_parser_state!(src.content);
 
     Ok(CompositionOffsetBox { samples: offsets })
 }

mp4parse/tests/clusterfuzz-testcase-minimized-mp4-6093954524250112

@@ -723,6 +723,13 @@ fn public_mp4_bug_1185230() {
     assert_eq!(number_audio_tracks, 2);
 }
 
+#[test]
+fn public_mp4_ctts_overflow() {
+    let input = &mut File::open("tests/clusterfuzz-testcase-minimized-mp4-6093954524250112")
+        .expect("Unknown file");
+    assert_invalid_data(mp4::read_mp4(input), "insufficient data in 'ctts' box");
+}
+
 #[test]
 fn public_avif_primary_item() {
     let input = &mut File::open(IMAGE_AVIF).expect("Unknown file");