arcodange/mediabunny
1
0
Fork 0
mirror of https://github.com/arcodange-org/mediabunny.git synced 2026-09-30 04:13:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix out of bounds reads for Matroska demuxer

Browse Source
This commit is contained in:
Vanilagy
2025-07-15 16:03:00 +02:00
parent cf0bbe896a
commit b1b493ab10
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "mediabunny",
"version": "1.1.0",
"version": "1.1.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "mediabunny",
"version": "1.1.0",
"version": "1.1.1",
"license": "MPL-2.0",
"dependencies": {
"@types/dom-mediacapture-transform": "^0.1.11",
package.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"name": "mediabunny",
"author": "Vanilagy",
"version": "1.1.0",
"version": "1.1.1",
"description": "Pure TypeScript media toolkit for reading, writing, and converting media files, directly in the browser.",
"type": "module",
"main": "./dist/bundles/mediabunny.cjs",
src/matroska/matroska-demuxer.ts
+3 -3
View File
@@ -220,7 +220,7 @@ export class MatroskaDemuxer extends Demuxer {
const fileSize = await this.input.source.getSize();
while (this.metadataReader.pos < fileSize - MIN_HEADER_SIZE) {
while (this.metadataReader.pos <= fileSize - MIN_HEADER_SIZE) {
await this.metadataReader.reader.loadRange(
this.metadataReader.pos,
this.metadataReader.pos + MAX_HEADER_SIZE,
@@ -557,7 +557,7 @@ export class MatroskaDemuxer extends Demuxer {
readContiguousElements(reader: EBMLReader, totalSize: number) {
const startIndex = reader.pos;
while (reader.pos - startIndex < totalSize) {
while (reader.pos - startIndex <= totalSize - MIN_HEADER_SIZE) {
this.traverseElement(reader);
}
}
@@ -1468,7 +1468,7 @@ abstract class MatroskaTrackBacking implements InputTrackBacking {
}
const endPos = dataStartPos + size;
if (endPos >= segment.elementEndPos - MIN_HEADER_SIZE) {
if (endPos > segment.elementEndPos - MIN_HEADER_SIZE) {
// No more elements fit in this segment
break;
} else {