avformat/aiffdec: fix signed integer overflow

Fixes #8151

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 61ef099f26f88d5c2e3e18cd6f8926d0deb7a6fe..a42987c15f7e1153883dc019df7c1d79a6a52465 100644 (file)
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -243,7 +243,10 @@ static int aiff_read_header(AVFormatContext *s)
         if (size < 0)
             return size;
 
-        filesize -= size + 8;
+        if (size >= 0x7fffffff - 8)
+            filesize = 0;
+        else
+            filesize -= size + 8;
 
         switch (tag) {
         case MKTAG('C', 'O', 'M', 'M'):     /* Common chunk */