Resize buffer to avoid overflow in QuickTimeVideo::userDataDecoder

[kevinbackhouse]

Fixes: #2366

[codecov]

Codecov Report

Merging #2367 (de6329d) into main (640b0fb) will increase coverage by 0.01%.
The diff coverage is 87.50%.

@@            Coverage Diff             @@
##             main    #2367      +/-   ##
==========================================
+ Coverage   63.51%   63.53%   +0.01%     
==========================================
  Files         119      119              
  Lines       20634    20602      -32     
  Branches    10245    10212      -33     
==========================================
- Hits        13106    13089      -17     
+ Misses       5399     5385      -14     
+ Partials     2129     2128       -1     

Impacted Files	Coverage Δ
src/quicktimevideo.cpp	58.15% <87.50%> (+1.18%)	⬆️
src/tiffimage_int.cpp	79.58% <0.00%> (-0.25%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[risicle]

I may be incorrect but isn't a similar unbounded copy into buf performed just a few lines before @

exiv2/src/quicktimevideo.cpp

Line 832 in a38e124

io_->readOrThrow(buf.data(), size - 8);

?

Or is there some assertion somewhere else that limits the value of size in those cases?

[risicle]

Ah - I see that's covered by one of the other CVEs.