A heap out-of-bounds memory write exists in the `build open gop key points()` function due to an integer overflow. This occurs when the size calculation adds `sc->ctts data[i].count` to `sc->sample offsets count`, potentially resulting in a small allocation with `av calloc()`. An attacker can cause remote code execution via a malicious mp4 file.