From af2010ff392be1941890bfad7b4565b3c21eb953 Mon Sep 17 00:00:00 2001 From: Acts1631 <69813585+acts-1631@users.noreply.github.com> Date: Mon, 3 Aug 2026 12:30:51 -0400 Subject: [PATCH] Matroska: limit elements in EBML containers (#1393) EBML containers could contain an unbounded number of small elements. The parser retained each element, allowing a crafted Matroska file to consume disproportionate memory. Reject containers that exceed a per-level element count limit. --- taglib/matroska/ebml/ebmlmasterelement.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/taglib/matroska/ebml/ebmlmasterelement.cpp b/taglib/matroska/ebml/ebmlmasterelement.cpp index 0b38416b..87f3dfd6 100644 --- a/taglib/matroska/ebml/ebmlmasterelement.cpp +++ b/taglib/matroska/ebml/ebmlmasterelement.cpp @@ -101,6 +101,7 @@ void EBML::MasterElement::setMinRenderSize(offset_t minimumSize) bool EBML::MasterElement::read(File &file, int depth) { static constexpr int MAX_EBML_DEPTH = 64; + static constexpr int MAX_EBML_ELEMENT_COUNT_PER_LEVEL = 50000; if(depth > MAX_EBML_DEPTH) { debug("EBML: Maximum nesting depth exceeded"); return false; @@ -108,6 +109,10 @@ bool EBML::MasterElement::read(File &file, int depth) const offset_t maxOffset = file.tell() + dataSize; std::unique_ptr element; while((element = findNextElement(file, maxOffset))) { + if(elements.size() >= MAX_EBML_ELEMENT_COUNT_PER_LEVEL) { + debug("EBML: Maximum element count exceeded"); + return false; + } if(auto master = dynamic_cast(element.get())) { if(!master->read(file, depth + 1)) { debug("EBML: Invalid MasterElement");