All media containers are potentially hostile. Any offset, extent, or reference has to be considered hostile user-provided input.