arcodange/mediabunny
1
0
Fork 0
mirror of https://github.com/arcodange-org/mediabunny.git synced 2026-10-03 05:43:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix out of bounds reads for Matroska demuxer

Browse Source
This commit is contained in:
Vanilagy
2025-07-15 16:03:00 +02:00
parent cf0bbe896a
commit b1b493ab10
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+2 -2
View File
@@ -1,12 +1,12 @@
{ {
"name": "mediabunny", "name": "mediabunny",
"version": "1.1.0", "version": "1.1.1",
"lockfileVersion": 3, "lockfileVersion": 3,
"requires": true, "requires": true,
"packages": { "packages": {
"": { "": {
"name": "mediabunny", "name": "mediabunny",
"version": "1.1.0", "version": "1.1.1",
"license": "MPL-2.0", "license": "MPL-2.0",
"dependencies": { "dependencies": {
"@types/dom-mediacapture-transform": "^0.1.11", "@types/dom-mediacapture-transform": "^0.1.11",
package.json
+1 -1
View File
@@ -1,7 +1,7 @@
{ {
"name": "mediabunny", "name": "mediabunny",
"author": "Vanilagy", "author": "Vanilagy",
"version": "1.1.0", "version": "1.1.1",
"description": "Pure TypeScript media toolkit for reading, writing, and converting media files, directly in the browser.", "description": "Pure TypeScript media toolkit for reading, writing, and converting media files, directly in the browser.",
"type": "module", "type": "module",
"main": "./dist/bundles/mediabunny.cjs", "main": "./dist/bundles/mediabunny.cjs",
src/matroska/matroska-demuxer.ts
+3 -3
View File
@@ -220,7 +220,7 @@ export class MatroskaDemuxer extends Demuxer {
const fileSize = await this.input.source.getSize(); const fileSize = await this.input.source.getSize();
while (this.metadataReader.pos < fileSize - MIN_HEADER_SIZE) { while (this.metadataReader.pos <= fileSize - MIN_HEADER_SIZE) {
await this.metadataReader.reader.loadRange( await this.metadataReader.reader.loadRange(
this.metadataReader.pos, this.metadataReader.pos,
this.metadataReader.pos + MAX_HEADER_SIZE, this.metadataReader.pos + MAX_HEADER_SIZE,
@@ -557,7 +557,7 @@ export class MatroskaDemuxer extends Demuxer {
readContiguousElements(reader: EBMLReader, totalSize: number) { readContiguousElements(reader: EBMLReader, totalSize: number) {
const startIndex = reader.pos; const startIndex = reader.pos;
while (reader.pos - startIndex < totalSize) { while (reader.pos - startIndex <= totalSize - MIN_HEADER_SIZE) {
this.traverseElement(reader); this.traverseElement(reader);
} }
} }
@@ -1468,7 +1468,7 @@ abstract class MatroskaTrackBacking implements InputTrackBacking {
} }
const endPos = dataStartPos + size; const endPos = dataStartPos + size;
if (endPos >= segment.elementEndPos - MIN_HEADER_SIZE) { if (endPos > segment.elementEndPos - MIN_HEADER_SIZE) {
// No more elements fit in this segment // No more elements fit in this segment
break; break;
} else { } else {