Add try/catch when reading elements with libmatroska.

(cherry picked from commit 59c9e8309d5b435a2d85c2c9eaae979ba56ccdd9)

Conflicts:
	modules/demux/mkv/matroska_segment.cpp

modules/demux/mkv/demux.cpp

@@ -462,16 +462,24 @@ matroska_stream_c *demux_sys_t::AnalyseAllSegmentsFound( demux_t *p_demux, EbmlS
     EbmlElement *p_l0, *p_l1, *p_l2;
     bool b_keep_stream = false, b_keep_segment = false;
 
-    // verify the EBML Header
-    p_l0 = p_estream->FindNextID(EBML_INFO(EbmlHead), UINT64_MAX);
+    /* verify the EBML Header... it shouldn't be bigger than 1kB */
+    p_l0 = p_estream->FindNextID(EBML_INFO(EbmlHead), 1024);
     if (p_l0 == NULL)
     {
         msg_Err( p_demux, "No EBML header found" );
         return NULL;
     }
 
-    // verify we can read this Segment, we only support Matroska version 1 for now
+    /* verify we can read this Segment */
+    try
+    {
         p_l0->Read(*p_estream, EBML_CLASS_CONTEXT(EbmlHead), i_upper_lvl, p_l0, true);
+    }
+    catch(...)
+    {
+        msg_Err(p_demux, "EBML Header Read failed");
+        return NULL;
+    }
 
     EDocType doc_type = GetChild<EDocType>(*static_cast<EbmlHead*>(p_l0));
     if (std::string(doc_type) != "matroska" && std::string(doc_type) != "webm" )
@@ -517,8 +525,15 @@ matroska_stream_c *demux_sys_t::AnalyseAllSegmentsFound( demux_t *p_demux, EbmlS
                     // find the families of this segment
                     KaxInfo *p_info = static_cast<KaxInfo*>(p_l1);
                     b_keep_segment = b_initial;
-
+                    try
+                    {
                         p_info->Read(*p_estream, EBML_CLASS_CONTEXT(KaxInfo), i_upper_lvl, p_l2, true);
+                    }
+                    catch (...)
+                    {
+                        msg_Err( p_demux, "KaxInfo found but corrupted");
+                        break;
+                    }
                     for( size_t i = 0; i < p_info->ListSize(); i++ )
                     {
                         EbmlElement *l = (*p_info)[i];

modules/demux/mkv/matroska_segment.cpp

@@ -120,6 +120,7 @@ matroska_segment_c::~matroska_segment_c()
  *****************************************************************************/
 void matroska_segment_c::LoadCues( KaxCues *cues )
 {
+    bool b_invalid_cue;
     EbmlParser  *ep;
     EbmlElement *el;
 
@@ -134,6 +135,7 @@ void matroska_segment_c::LoadCues( KaxCues *cues )
     {
         if( MKV_IS_ID( el, KaxCuePoint ) )
         {
+            b_invalid_cue = false;
 #define idx p_indexes[i_index]
 
             idx.i_track       = -1;
@@ -148,14 +150,23 @@ void matroska_segment_c::LoadCues( KaxCues *cues )
                 if( MKV_IS_ID( el, KaxCueTime ) )
                 {
                     KaxCueTime &ctime = *(KaxCueTime*)el;
-
+                    try
+                    {
                         ctime.ReadData( es.I_O() );
-
+                    }
+                    catch(...)
+                    {
+                        msg_Err( &sys.demuxer, "Error while reading CueTime" );
+                        b_invalid_cue = true;
+                        break;
+                    }
                     idx.i_time = uint64( ctime ) * i_timescale / (mtime_t)1000;
                 }
                 else if( MKV_IS_ID( el, KaxCueTrackPositions ) )
                 {
                     ep->Down();
+                    try
+                    {
                         while( ( el = ep->Get() ) != NULL )
                         {
                             if( MKV_IS_ID( el, KaxCueTrack ) )
@@ -184,6 +195,14 @@ void matroska_segment_c::LoadCues( KaxCues *cues )
                                 msg_Dbg( &sys.demuxer, "         * Unknown (%s)", typeid(*el).name() );
                             }
                         }
+                    }
+                    catch(...)
+                    {
+                        ep->Up();   
+                        msg_Err( &sys.demuxer, "Error while reading %s", typeid(*el).name() );
+                        b_invalid_cue = true;
+                        break;
+                    }
                     ep->Up();
                 }
                 else
@@ -198,7 +217,8 @@ void matroska_segment_c::LoadCues( KaxCues *cues )
                      " track=%d bnum=%d", idx.i_time, idx.i_position,
                      idx.i_track, idx.i_block_number );
 #endif
-
+            if( likely( !b_invalid_cue ) )
+            {
                 i_index++;
                 if( i_index >= i_index_max )
                 {
@@ -206,6 +226,7 @@ void matroska_segment_c::LoadCues( KaxCues *cues )
                     p_indexes = (mkv_index_t*)xrealloc( p_indexes,
                                                         sizeof( mkv_index_t ) * i_index_max );
                 }
+            }
 #undef idx
         }
         else
@@ -254,6 +275,8 @@ void matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag )
         sys.meta = vlc_meta_New();
 
     msg_Dbg( &sys.demuxer, "|   + Simple Tag ");
+    try
+    {
         while( ( el = ep->Get() ) != NULL )
         {
             if( MKV_IS_ID( el, KaxTagName ) )
@@ -262,13 +285,22 @@ void matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag )
                 key.ReadData( es.I_O(), SCOPE_ALL_DATA );
                 k = strdup( UTFstring( key ).GetUTF8().c_str() );
             }
-        if( MKV_IS_ID( el, KaxTagString ) )
+            else if( MKV_IS_ID( el, KaxTagString ) )
             {
                 KaxTagString &value = *(KaxTagString*)el;
                 value.ReadData( es.I_O(), SCOPE_ALL_DATA );
                 v = strdup( UTFstring( value ).GetUTF8().c_str() );
             }
         }
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Error while reading Tag ");
+        free(k);
+        free(v);
+        delete ep;
+        return;
+    }
     delete ep;
 
     if( !k || !v )
@@ -1502,6 +1534,8 @@ int matroska_segment_c::BlockGet( KaxBlock * & pp_block, KaxSimpleBlock * & pp_s
         }
 
         /* do parsing */
+        try
+        {
             switch ( i_level )
             {
                 case 1:
@@ -1607,5 +1641,11 @@ int matroska_segment_c::BlockGet( KaxBlock * & pp_block, KaxSimpleBlock * & pp_s
                     return VLC_EGENERIC;
             }
         }
+        catch(...)
+        {
+            msg_Err( &sys.demuxer, "Error while reading %s... upping level", typeid(*el).name());
+            ep->Up();
+        }
+    }
 }
 

modules/demux/mkv/matroska_segment_parse.cpp

@@ -66,6 +66,8 @@ void matroska_segment_c::ParseSeekHead( KaxSeekHead *seekhead )
             msg_Dbg( &sys.demuxer, "|   |   + Seek" );
 #endif
             ep->Down();
+            try
+            {
                 while( ( l = ep->Get() ) != NULL )
                 {
                     if( MKV_IS_ID( l, KaxSeekID ) )
@@ -86,6 +88,11 @@ void matroska_segment_c::ParseSeekHead( KaxSeekHead *seekhead )
                         msg_Dbg( &sys.demuxer, "|   |   + Unknown (%s)", typeid(*l).name() );
                     }
                 }
+            }
+            catch(...)
+            {
+                msg_Err( &sys.demuxer,"Error while reading %s",  typeid(*l).name() );
+            }
             ep->Up();
 
             if( i_pos >= 0 )
@@ -668,7 +675,15 @@ void matroska_segment_c::ParseTracks( KaxTracks *tracks )
     int i_upper_level = 0;
 
     /* Master elements */
+    try
+    {
         tracks->Read( es, EBML_CONTEXT(tracks), i_upper_level, el, true );
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Couldn't read tracks" );
+        return;
+    }
 
     for( size_t i = 0; i < tracks->ListSize(); i++ )
     {
@@ -696,7 +711,15 @@ void matroska_segment_c::ParseInfo( KaxInfo *info )
 
     /* Master elements */
     m = static_cast<EbmlMaster *>(info);
+    try
+    {
         m->Read( es, EBML_CONTEXT(info), i_upper_level, el, true );
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Couldn't read info" );
+        return;
+    }   
 
     for( size_t i = 0; i < m->ListSize(); i++ )
     {
@@ -809,9 +832,11 @@ void matroska_segment_c::ParseInfo( KaxInfo *info )
         else if( MKV_IS_ID( l, KaxChapterTranslate ) )
         {
             KaxChapterTranslate *p_trans = static_cast<KaxChapterTranslate*>( l );
+            try
+            {
+                p_trans->Read( es, EBML_CONTEXT(p_trans), i_upper_level, el, true );
                 chapter_translation_c *p_translate = new chapter_translation_c();
 
-            p_trans->Read( es, EBML_CONTEXT(p_trans), i_upper_level, el, true );
                 for( size_t j = 0; j < p_trans->ListSize(); j++ )
                 {
                     EbmlElement *l = (*p_trans)[j];
@@ -832,6 +857,11 @@ void matroska_segment_c::ParseInfo( KaxInfo *info )
 
                 translations.push_back( p_translate );
             }
+            catch(...)
+            {
+                msg_Err( &sys.demuxer, "Error while reading Chapter Tranlate");
+            }
+        }
         else
         {
             msg_Dbg( &sys.demuxer, "|   |   + Unknown (%s)", typeid(*l).name() );
@@ -994,7 +1024,15 @@ void matroska_segment_c::ParseAttachments( KaxAttachments *attachments )
     EbmlElement *el;
     int i_upper_level = 0;
 
+    try
+    {
         attachments->Read( es, EBML_CONTEXT(attachments), i_upper_level, el, true );
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Error while reading attachments" );
+        return;
+    }
 
     KaxAttached *attachedFile = FindChild<KaxAttached>( *attachments );
 
@@ -1041,7 +1079,15 @@ void matroska_segment_c::ParseChapters( KaxChapters *chapters )
     int i_upper_level = 0;
 
     /* Master elements */
+    try
+    {
         chapters->Read( es, EBML_CONTEXT(chapters), i_upper_level, el, true );
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Error while reading chapters" );
+        return;
+    }
 
     for( size_t i = 0; i < chapters->ListSize(); i++ )
     {
@@ -1102,7 +1148,15 @@ void matroska_segment_c::ParseCluster( bool b_update_start_time )
 
     /* Master elements */
     m = static_cast<EbmlMaster *>( cluster );
+    try
+    {
         m->Read( es, EBML_CONTEXT(cluster), i_upper_level, el, true );
+    }
+    catch(...)
+    {
+        msg_Err( &sys.demuxer, "Error while reading cluster" );
+        return;
+    }
 
     for( unsigned int i = 0; i < m->ListSize(); i++ )
     {