[oss-fuzz 5993053760585728] Integer-overflow MP4_ReadBox_tkhd

Ref:

• https://oss-fuzz.com/testcase-detail/5993053760585728

demux/mp4/libmp4.c:1308:23: runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
    #0 0x5c5df7fe45b4 in MP4_ReadBox_tkhd /src/vlc/modules/demux/mp4/libmp4.c:1308:23
    #1 0x5c5df7fdd592 in MP4_Box_Read_Specific /src/vlc/modules/demux/mp4/libmp4.c:5367:10
    #2 0x5c5df7fdd592 in MP4_ReadBoxRestricted /src/vlc/modules/demux/mp4/libmp4.c:453:9
    #3 0x5c5df7fdd592 in MP4_ReadBoxContainerChildrenIndexed /src/vlc/modules/demux/mp4/libmp4.c:523:22
    #4 0x5c5df7fdd592 in MP4_Box_Read_Specific /src/vlc/modules/demux/mp4/libmp4.c:5367:10
    #5 0x5c5df7fdd592 in MP4_ReadBoxRestricted /src/vlc/modules/demux/mp4/libmp4.c:453:9
    #6 0x5c5df7fdd592 in MP4_ReadBoxContainerChildrenIndexed /src/vlc/modules/demux/mp4/libmp4.c:523:22
    #7 0x5c5df7fdd592 in MP4_Box_Read_Specific /src/vlc/modules/demux/mp4/libmp4.c:5367:10
    #8 0x5c5df7fdd592 in MP4_ReadBoxRestricted /src/vlc/modules/demux/mp4/libmp4.c:453:9
    #9 0x5c5df7fdd592 in MP4_ReadBoxContainerChildrenIndexed /src/vlc/modules/demux/mp4/libmp4.c:523:22
    #10 0x5c5df7fdf32c in MP4_ReadBoxContainerChildren /src/vlc/modules/demux/mp4/libmp4.c:573:12
    #11 0x5c5df7fdf32c in MP4_BoxGetRoot /src/vlc/modules/demux/mp4/libmp4.c:5538:20
    #12 0x5c5df7fb133e in LoadInitFrag /src/vlc/modules/demux/mp4/mp4.c:689:25
    #13 0x5c5df7fb133e in Open /src/vlc/modules/demux/mp4/mp4.c:1058:9
    #14 0x5c5df829bf11 in demux_Probe /src/vlc/src/input/demux.c:112:15
    #15 0x5c5df826fa75 in vlc_module_load /src/vlc/src/modules/modules.c:230:15
    #16 0x5c5df829b997 in demux_NewAdvanced /src/vlc/src/input/demux.c:196:20
    #17 0x5c5df829b323 in demux_New /src/vlc/src/input/demux.c:77:12
    #18 0x5c5df7f60440 in demux_process_stream /src/vlc/test/src/input/demux-run.c:300:22
    #19 0x5c5df7f60283 in LLVMFuzzerTestOneInput /src/vlc/test/vlc-demux-libfuzzer.c:63:5
    #20 0x5c5df7ec2760 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #21 0x5c5df7ead9d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #22 0x5c5df7eb346f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #23 0x5c5df7ede712 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #24 0x79fd2222a082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
    #25 0x5c5df7ea5bbd in _start

Sample:

• clusterfuzz-testcase-minimized-vlc-demux-dec-libfuzzer-5993053760585728