Missing verification on the range for the user-controlled 'nb_entries' ((u64)ptr->nb_entries * sizeof(u64) must not be greater than a 32-bit int) results in an inconsistent value, which becomes a wrong argument for the multiplication ‘*’ operator in 'ptr->nb_entries * sizeof(u64)' . The result wraps around (integer overflow on a 32-bit platform) and becomes a small number used to allocate insufficient size memory for the 'ptr->offsets[entries]' buffer, allowing a pointer reposition over its bounds, which, when used to write leads to a heap buffer overflow. If exploited, this can lead to denial of service (DOS) --availability loss, or arbitrary code execution (ACE) and more specificqlly remote code execution (RCE) -- everything could be lost.

//generated// Missing Code (in ‘co64_box_read(GF_Box *s,GF_BitStream bs)’) to Verify upper bound via Range ((u64)ptr->nb_entries <= (u64)SIZE_MAX / sizeof(u64)) of Stored in Third-Party (src/isomedia/box_code_base.c#L54) Local leads to Inconsistent Value (‘ptr->nb_entries’) , which propagates to Wrong Argument (in ‘(ptr->nb_entries * sizeof(u64))’) Operator Calculate (multiplication ‘’) Bound Numeric (u32 integer) Structure (GF_ChunkLargeOffsetBox *ptr) Third-Party (src/isomedia/box_code_base.c#L54) in Local that results in Wrap Around ((integer overflow on a 32-bit platform)) , which propagates to Wrong Size (in ‘ptr->offsets = (u64 *) gf_malloc’(ptr->nb_entries * sizeof(u64) );’ (size is too small)) Explicit Allocate (gf_malloc()) Third-Party (src/isomedia/box_code_base.c#L54) in Userland that results in Insufficient Size , which propagates to Insufficient Size Sequential Reposition (pointer) Heap Used Third-Party (src/isomedia/box_code_base.c#L57) in Userland that results in Overbound Pointer (‘ptr->offsets[entries]’) , which propagates to Overbound Pointer (in ‘ptr->offsets[entries] = gf_bs_read_u64(bs);’) Sequential Write (object) Huge Heap Used Third-Party (src/isomedia/box_code_base.c#L58) in Userland that results in Buffer Overflow , which can be exploited toward Arbitrary Code Execution (ACE) (Remote Code Execution (RCE) - everything could be lost) or Denial of Service (DOS) ((availability loss)) security failure.