From 14604ec4b797248222cdd72a74d39abbdad9b343 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 1 Jul 2026 06:18:07 +0200
Subject: [PATCH] avformat/iff: reject invalid data_size in ANIM

Fixes: 520277418/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6733106211258368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/iff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index 74362d29f2..456b7e35da 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -992,6 +992,8 @@ static int iff_read_packet(AVFormatContext *s,
         if (pb->eof_reached)
             return AVERROR_EOF;
 
+        if (!data_size || data_size > INT_MAX)
+            return AVERROR_INVALIDDATA;
         ret = av_get_packet(pb, pkt, data_size);
         if (ret < 0)
             return ret;