avio_skip(pb, 4);
count = avio_rb32(pb);
- if (count > UINT_MAX / sizeof(*c->meta_keys)) {
+ if (count > UINT_MAX / sizeof(*c->meta_keys) - 1) {
av_log(c->fc, AV_LOG_ERROR,
"The 'keys' atom with the invalid key count: %d\n", count);
return AVERROR_INVALIDDATA;