mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2026-08-14 06:17:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

Matroska: limit elements in EBML containers (#1393)

Browse Source 
EBML containers could contain an unbounded number of small elements.
The parser retained each element, allowing a crafted Matroska file to
consume disproportionate memory.

Reject containers that exceed a per-level element count limit.
This commit is contained in:
Acts1631
2026-08-03 18:30:51 +02:00
committed by GitHub
parent c0f2a939b4
commit af2010ff39
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglib/matroska/ebml/ebmlmasterelement.cpp
+5
View File
@@ -101,6 +101,7 @@ void EBML::MasterElement::setMinRenderSize(offset_t minimumSize)
bool EBML::MasterElement::read(File &file, int depth)
{
static constexpr int MAX_EBML_DEPTH = 64;
static constexpr int MAX_EBML_ELEMENT_COUNT_PER_LEVEL = 50000;
if(depth > MAX_EBML_DEPTH) {
debug("EBML: Maximum nesting depth exceeded");
return false;
@@ -108,6 +109,10 @@ bool EBML::MasterElement::read(File &file, int depth)
const offset_t maxOffset = file.tell() + dataSize;
std::unique_ptr<Element> element;
while((element = findNextElement(file, maxOffset))) {
if(elements.size() >= MAX_EBML_ELEMENT_COUNT_PER_LEVEL) {
debug("EBML: Maximum element count exceeded");
return false;
}
if(auto master = dynamic_cast<MasterElement *>(element.get())) {
if(!master->read(file, depth + 1)) {
debug("EBML: Invalid MasterElement");