From 7d69d5de48cb7b77d80de128a70492d37ca3d0ee Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Sat, 1 Aug 2026 18:23:41 -0400 Subject: [PATCH] demux_mkv: skip malformed TrackEntry elements The Matroska demuxer creates persistent track state even if a TrackEntry lacks mandatory fields. A malformed file can use a large list of such entries to consume memory while it is opened. Check TrackNumber, TrackUID, TrackType, and CodecID before creating per-track state. Valid files with large track counts retain their existing behavior. --- demux/demux_mkv.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c index e9159d752b5c7..37a2b3a72ab17 100644 --- a/demux/demux_mkv.c +++ b/demux/demux_mkv.c @@ -1022,8 +1022,16 @@ static int demux_mkv_read_tracks(demuxer_t *demuxer) mkv_d->tracks = talloc_zero_array(mkv_d, struct mkv_track*, tracks.n_track_entry); for (int i = 0; i < tracks.n_track_entry; i++) { + struct ebml_track_entry *entry = &tracks.track_entry[i]; + if (!entry->n_track_number || !entry->track_number || + !entry->n_track_uid || !entry->track_uid || + !entry->n_track_type || !entry->track_type || + !entry->codec_id || !entry->codec_id[0]) { + MP_WARN(demuxer, "Ignoring malformed TrackEntry.\n"); + continue; + } MP_DBG(demuxer, "| + a track...\n"); - parse_trackentry(demuxer, &tracks.track_entry[i]); + parse_trackentry(demuxer, entry); } talloc_free(parse_ctx.talloc_ctx); return 0;