From b1b493ab10b7d022af32ee2a1adc946050fade39 Mon Sep 17 00:00:00 2001
From: Vanilagy <1696106+Vanilagy@users.noreply.github.com>
Date: Tue, 15 Jul 2025 16:03:00 +0200
Subject: [PATCH] Fix out of bounds reads for Matroska demuxer

---
 package-lock.json                | 4 ++--
 package.json                     | 2 +-
 src/matroska/matroska-demuxer.ts | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fcf4bd7..6300110 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "mediabunny",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mediabunny",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "license": "MPL-2.0",
       "dependencies": {
         "@types/dom-mediacapture-transform": "^0.1.11",
diff --git a/package.json b/package.json
index 9165bbf..8ac74a2 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "mediabunny",
   "author": "Vanilagy",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Pure TypeScript media toolkit for reading, writing, and converting media files, directly in the browser.",
   "type": "module",
   "main": "./dist/bundles/mediabunny.cjs",
diff --git a/src/matroska/matroska-demuxer.ts b/src/matroska/matroska-demuxer.ts
index d04ea47..30f1ffd 100644
--- a/src/matroska/matroska-demuxer.ts
+++ b/src/matroska/matroska-demuxer.ts
@@ -220,7 +220,7 @@ export class MatroskaDemuxer extends Demuxer {
 
 			const fileSize = await this.input.source.getSize();
 
-			while (this.metadataReader.pos < fileSize - MIN_HEADER_SIZE) {
+			while (this.metadataReader.pos <= fileSize - MIN_HEADER_SIZE) {
 				await this.metadataReader.reader.loadRange(
 					this.metadataReader.pos,
 					this.metadataReader.pos + MAX_HEADER_SIZE,
@@ -557,7 +557,7 @@ export class MatroskaDemuxer extends Demuxer {
 	readContiguousElements(reader: EBMLReader, totalSize: number) {
 		const startIndex = reader.pos;
 
-		while (reader.pos - startIndex < totalSize) {
+		while (reader.pos - startIndex <= totalSize - MIN_HEADER_SIZE) {
 			this.traverseElement(reader);
 		}
 	}
@@ -1468,7 +1468,7 @@ abstract class MatroskaTrackBacking implements InputTrackBacking {
 					}
 
 					const endPos = dataStartPos + size;
-					if (endPos >= segment.elementEndPos - MIN_HEADER_SIZE) {
+					if (endPos > segment.elementEndPos - MIN_HEADER_SIZE) {
 						// No more elements fit in this segment
 						break;
 					} else {