In the M4A demuxer of m4a_demux.c, the first_chunk field of an stsc box entry is read directly from an untrusted M4A/MP4 file with no validation that it is at least 1, as required by the ISO-BMFF specification. A crafted file setting first_chunk to 0 causes a subsequent chunk-1 computation to underflow to 0xFFFFFFFF, producing a wild out-of-bounds pointer read when locating a sample's offset in the stco/co64 chunk-offset table, and a further out-of-bounds read when copying sample data using that offset. This is reachable simply by playing an attacker-supplied .m4a or .mp4 file through the media player.
CWE-191, CWE-125
Artfical DT Developer Talha Berk Arslan