From d8990137eec96e8ead292f5de2fc2c6de450e676 Mon Sep 17 00:00:00 2001
From: Ted Meyer <tmathmeyer@chromium.org>
Date: Wed, 15 Oct 2025 14:00:18 -0700
Subject: [PATCH] libavformat/flacdec: error on overflow in metadata

if accumulating metadata_head_size would lead to an integer overflow,
return an error instead
---
 libavformat/flacdec.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavformat/flacdec.c b/libavformat/flacdec.c
index 12d4b7305f..1f5cfeed71 100644
--- a/libavformat/flacdec.c
+++ b/libavformat/flacdec.c
@@ -42,12 +42,16 @@ typedef struct FLACDecContext {
     AVCodecContext *parser_dec;
 } FLACDecContext;
 
-static void reset_index_position(int64_t metadata_head_size, AVStream *st)
+static int reset_index_position(int64_t metadata_head_size, AVStream *st)
 {
     FFStream *const sti = ffstream(st);
     /* the real seek index offset should be the size of metadata blocks with the offset in the frame blocks */
-    for (int i = 0; i < sti->nb_index_entries; i++)
+    for (int i = 0; i < sti->nb_index_entries; i++) {
+        if (0x7FFFFFFFFFFFFFFF - metadata_head_size < sti->index_entries[i].pos)
+            return AVERROR_INVALIDDATA;
         sti->index_entries[i].pos += metadata_head_size;
+    }
+    return 0;
 }
 
 static const uint16_t sr_table[16] = {
@@ -225,7 +229,8 @@ static int flac_read_header(AVFormatContext *s)
     if (ret < 0)
         return ret;
 
-    reset_index_position(avio_tell(s->pb), st);
+    if (ret = reset_index_position(avio_tell(s->pb), st))
+        return ret;
     return 0;
 
 fail: