Commit d8990137ee for ffmpeg

commit d8990137eec96e8ead292f5de2fc2c6de450e676
Author: Ted Meyer <tmathmeyer@chromium.org>
Date:   Wed Oct 15 14:00:18 2025 -0700

    libavformat/flacdec: error on overflow in metadata

    if accumulating metadata_head_size would lead to an integer overflow,
    return an error instead

diff --git a/libavformat/flacdec.c b/libavformat/flacdec.c
index 12d4b7305f..1f5cfeed71 100644
--- a/libavformat/flacdec.c
+++ b/libavformat/flacdec.c
@@ -42,12 +42,16 @@ typedef struct FLACDecContext {
     AVCodecContext *parser_dec;
 } FLACDecContext;

-static void reset_index_position(int64_t metadata_head_size, AVStream *st)
+static int reset_index_position(int64_t metadata_head_size, AVStream *st)
 {
     FFStream *const sti = ffstream(st);
     /* the real seek index offset should be the size of metadata blocks with the offset in the frame blocks */
-    for (int i = 0; i < sti->nb_index_entries; i++)
+    for (int i = 0; i < sti->nb_index_entries; i++) {
+        if (0x7FFFFFFFFFFFFFFF - metadata_head_size < sti->index_entries[i].pos)
+            return AVERROR_INVALIDDATA;
         sti->index_entries[i].pos += metadata_head_size;
+    }
+    return 0;
 }

 static const uint16_t sr_table[16] = {
@@ -225,7 +229,8 @@ static int flac_read_header(AVFormatContext *s)
     if (ret < 0)
         return ret;

-    reset_index_position(avio_tell(s->pb), st);
+    if (ret = reset_index_position(avio_tell(s->pb), st))
+        return ret;
     return 0;

 fail: