arcodange/mediabunny
1
0
Fork 0
mirror of https://github.com/arcodange-org/mediabunny.git synced 2026-10-02 21:33:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix out of bounds reads for Matroska demuxer

Browse Source
This commit is contained in:
Vanilagy
2025-07-15 16:03:00 +02:00
parent cf0bbe896a
commit b1b493ab10
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/matroska/matroska-demuxer.ts
+3 -3
View File
@@ -220,7 +220,7 @@ export class MatroskaDemuxer extends Demuxer {
const fileSize = await this.input.source.getSize();
while (this.metadataReader.pos < fileSize - MIN_HEADER_SIZE) {
while (this.metadataReader.pos <= fileSize - MIN_HEADER_SIZE) {
await this.metadataReader.reader.loadRange(
this.metadataReader.pos,
this.metadataReader.pos + MAX_HEADER_SIZE,
@@ -557,7 +557,7 @@ export class MatroskaDemuxer extends Demuxer {
readContiguousElements(reader: EBMLReader, totalSize: number) {
const startIndex = reader.pos;
while (reader.pos - startIndex < totalSize) {
while (reader.pos - startIndex <= totalSize - MIN_HEADER_SIZE) {
this.traverseElement(reader);
}
}
@@ -1468,7 +1468,7 @@ abstract class MatroskaTrackBacking implements InputTrackBacking {
}
const endPos = dataStartPos + size;
if (endPos >= segment.elementEndPos - MIN_HEADER_SIZE) {
if (endPos > segment.elementEndPos - MIN_HEADER_SIZE) {
// No more elements fit in this segment
break;
} else {