Resize buffer to avoid overflow in QuickTimeVideo::userDataDecoder

[kevinbackhouse]

Fixes: #2366

[codecov[bot]]

Codecov Report

Merging #2367 (de6329d) into main (640b0fb) will increase coverage by 0.01%. The diff coverage is 87.50%.

@@            Coverage Diff             @@
##             main    #2367      +/-   ##
==========================================
+ Coverage   63.51%   63.53%   +0.01%     
==========================================
  Files         119      119              
  Lines       20634    20602      -32     
  Branches    10245    10212      -33     
==========================================
- Hits        13106    13089      -17     
+ Misses       5399     5385      -14     
+ Partials     2129     2128       -1     

Impacted Files	Coverage Δ
src/quicktimevideo.cpp	58.15% <87.50%> (+1.18%)	:arrow_up:
src/tiffimage_int.cpp	79.58% <0.00%> (-0.25%)	:arrow_down:

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[risicle]

I may be incorrect but isn't a similar unbounded copy into buf performed just a few lines before @ https://github.com/Exiv2/exiv2/blob/a38e124076138e529774d5ec9890d0731058115a/src/quicktimevideo.cpp#L832 ?

Or is there some assertion somewhere else that limits the value of size in those cases?

[risicle]

Ah - I see that's covered by one of the other CVEs.