[vlc-commits] [Git][videolan/vlc][master] 2 commits: contrib: ebml: fix leak on upper element found inside last element

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
f271469e by Steve Lhomme at 2026-06-03T10:43:36+00:00
contrib: ebml: fix leak on upper element found inside last element

Fixes #29887

- - - - -
ca850d69 by Steve Lhomme at 2026-06-03T10:43:36+00:00
demux: mkv: use misplaced element logging

It was dead code following 5ce2f287851396e650d57da3f9804e2653198aaf.

- - - - -


3 changed files:

- + contrib/src/ebml/0001-EbmlMaster-fix-leak-on-upper-element-found-inside-th.patch
- contrib/src/ebml/rules.mak
- modules/demux/mkv/matroska_segment_parse.cpp


Changes:

=====================================
contrib/src/ebml/0001-EbmlMaster-fix-leak-on-upper-element-found-inside-th.patch
=====================================
@@ -0,0 +1,51 @@
+From 370bcc4fb22af9d07bca911457e5fe20119e3bd2 Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4 at ycbcr.xyz>
+Date: Tue, 2 Jun 2026 11:37:54 +0200
+Subject: [PATCH] EbmlMaster: fix leak on upper element found inside the last
+ element
+
+We found an upper element and there is not data to read after the current
+element within its parent. That upper element is misplaced and should be
+discarded.
+The last element is truncated and doesn't contain the rest of its data.
+---
+ src/EbmlMaster.cpp | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/src/EbmlMaster.cpp b/src/EbmlMaster.cpp
+index 4851618..d91ab06 100644
+--- a/src/EbmlMaster.cpp
++++ b/src/EbmlMaster.cpp
+@@ -445,8 +445,13 @@ void EbmlMaster::Read(EbmlStream & inDataStream, const EbmlSemanticContext & sCo
+ 
+           if (UpperEltFound) {
+             --UpperEltFound;
+-            if (UpperEltFound > 0 || MaxSizeToRead <= 0)
++            if (UpperEltFound > 0)
+               goto processCrc;
++            if (MaxSizeToRead <= 0) {
++              delete FoundElt;
++              FoundElt = nullptr;
++              goto processCrc;
++            }
+             ElementLevelA = FoundElt;
+           }
+ 
+@@ -456,8 +461,13 @@ void EbmlMaster::Read(EbmlStream & inDataStream, const EbmlSemanticContext & sCo
+ 
+       if (UpperEltFound > 0) {
+         UpperEltFound--;
+-        if (UpperEltFound > 0 || MaxSizeToRead <= 0)
++        if (UpperEltFound > 0)
++          goto processCrc;
++        if (MaxSizeToRead <= 0) {
++          delete FoundElt;
++          FoundElt = nullptr;
+           goto processCrc;
++        }
+         ElementLevelA = FoundElt;
+         if (IsFiniteSize() && ElementLevelA->IsFiniteSize()) {
+           if (ElementLevelA->GetEndPosition() > GetEndPosition()) {
+-- 
+2.52.0.windows.1
+


=====================================
contrib/src/ebml/rules.mak
=====================================
@@ -22,6 +22,7 @@ ebml: libebml-$(EBML_VERSION).tar.xz .sum-ebml
 	$(APPLY) $(SRC)/ebml/0001-EbmlHead-do-not-allow-to-have-an-infinite-unknown-si.patch
 	$(APPLY) $(SRC)/ebml/0001-include-iterator-for-std-back_inserter.patch
 	$(APPLY) $(SRC)/ebml/0002-include-new-for-std-nothrow.patch
+	$(APPLY) $(SRC)/ebml/0001-EbmlMaster-fix-leak-on-upper-element-found-inside-th.patch
 	$(MOVE)
 
 .ebml: ebml toolchain.cmake


=====================================
modules/demux/mkv/matroska_segment_parse.cpp
=====================================
@@ -790,15 +790,14 @@ void matroska_segment_c::ParseTrackEntry( const KaxTrackEntry *m )
 #if LIBMATROSKA_VERSION >= 0x010405
         E_CASE( KaxVideoColour, colours)
         {
-            ONLY_FMT(VIDEO);
             debug( vars, "Video Colors");
             if (vars.tk->fmt.i_cat != VIDEO_ES ) {
                 msg_Err( vars.p_demuxer, "Video colors elements not allowed for this track" );
-            } else {
+                return;
+            }
             vars.level += 1;
             dispatcher.iterate (colours.begin (), colours.end (), &vars );
             vars.level -= 1;
-            }
         }
         E_CASE( KaxVideoColourRange, range )
         {
@@ -975,15 +974,14 @@ void matroska_segment_c::ParseTrackEntry( const KaxTrackEntry *m )
         }
         E_CASE( KaxVideoColourMasterMeta, mastering )
         {
-            ONLY_FMT(VIDEO);
             debug( vars, "Video Mastering Metadata");
             if (vars.tk->fmt.i_cat != VIDEO_ES ) {
                 msg_Err( vars.p_demuxer, "Video metadata elements not allowed for this track" );
-            } else {
+                return;
+            }
             vars.level += 1;
             dispatcher.iterate (mastering.begin (), mastering.end (), &vars );
             vars.level -= 1;
-            }
         }
         E_CASE( KaxVideoLuminanceMax, maxLum )
         {



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/b6145973e2256338715f08d62c05e26b51faee82...ca850d6979a333e8fe191532e46c078f4724facf

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/b6145973e2256338715f08d62c05e26b51faee82...ca850d6979a333e8fe191532e46c078f4724facf
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help