demux: mp4: have ReadBox check final size

(cherry picked from commit cadfe695b4c138aa8708dc7c8cc5ecbdad77696c)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

modules/demux/mp4/libmp4.c

@@ -3576,6 +3576,15 @@ static MP4_Box_t *MP4_ReadBox( stream_t *p_stream, MP4_Box_t *p_father )
         free( p_box );
         return NULL;
     }
+
+    if( p_father && p_father->i_size > 0 &&
+        p_father->i_pos + p_father->i_size < p_box->i_pos + p_box->i_size )
+    {
+        msg_Dbg( p_stream, "out of bound child" );
+        free( p_box );
+        return NULL;
+    }
+
     if( !p_box->i_size )
     {
         msg_Dbg( p_stream, "found an empty box (null size)" );