Don't panic when a box's size is smaller than its header.

Author: Zaggy1024

mp4parse/src/lib.rs

@@ -2422,7 +2422,7 @@ fn skip_box_content<T: Read>(src: &mut BMFFBox<T>) -> Result<()> {
         header
             .size
             .checked_sub(header.offset)
-            .expect("header offset > size")
+            .ok_or(Error::Unsupported("Skipping past unknown sized box"))?
     };
     assert_eq!(to_skip, src.bytes_left());
     skip(src, to_skip)

mp4parse/tests/public.rs

@@ -66,6 +66,8 @@ static IMAGE_AVIF_IROT_MISSING_ESSENTIAL: &str = "tests/irot-missing-essential.a
 static IMAGE_AVIF_LSEL_MISSING_ESSENTIAL: &str = "tests/corrupt/lsel-missing-essential.avif";
 static IMAGE_AVIF_CLAP_MISSING_ESSENTIAL: &str = "tests/clap-missing-essential.avif";
 static IMAGE_AVIF_UNKNOWN_MDAT_SIZE: &str = "tests/unknown_mdat.avif";
+static IMAGE_AVIF_UNKNOWN_MDAT_SIZE_IN_OVERSIZED_META: &str =
+    "tests/unknown_mdat_in_oversized_meta.avif";
 static AVIF_TEST_DIRS: &[&str] = &["tests", "av1-avif/testFiles", "link-u-avif-sample-images"];
 
 // These files are
@@ -124,6 +126,7 @@ static AVIF_UNSUPPORTED_IMAGES: &[&str] = &[
 /// and https://github.com/AOMediaCodec/av1-avif/issues/178
 // TODO: make this into a map of expected errors?
 static AV1_AVIF_CORRUPT_IMAGES: &[&str] = &[
+    IMAGE_AVIF_UNKNOWN_MDAT_SIZE_IN_OVERSIZED_META,
     "av1-avif/testFiles/Link-U/kimono.crop.avif",
     "av1-avif/testFiles/Link-U/kimono.mirror-horizontal.avif",
     "av1-avif/testFiles/Link-U/kimono.mirror-vertical.avif",
@@ -926,6 +929,16 @@ fn public_avif_unknown_mdat() {
     );
 }
 
+#[test]
+fn public_avif_unknown_mdat_in_oversized_meta() {
+    let input =
+        &mut File::open(IMAGE_AVIF_UNKNOWN_MDAT_SIZE_IN_OVERSIZED_META).expect("Unknown file");
+    assert_eq!(
+        Status::from(mp4::read_avif(input, ParseStrictness::Normal)),
+        Status::Unsupported
+    );
+}
+
 #[test]
 fn public_avif_bug_1655846() {
     let input = &mut File::open(IMAGE_AVIF_CORRUPT).expect("Unknown file");