heap buffer overflow is found in MatroskaDemuxer::matroska_parse_block() about tsmuxer

[jcdr428]

Ok, I reopen the issue as the bof needs another solution (see issue #874).
EMBL lacing is explained here: lace and n are not really linked.
The data buffer is composed of:

• Byte 1 = lace = Number of frames minus 1.
• Then we have the size of first frame in VINT format.
• Then we have the size of following frames except last one, as a difference from previous frame size.
• Then we have the data for each frame. Size of last frame is the remaining bytes.

So we have to check when ready each frame size, that this frame size is not > remaining buffer bytes.

[jcdr428]

Edit: @JP3BGY actually your POC is a specific case where there is only one frame in the EBML lacing. In which case, no need to deduct the size of the last frame from the remaining bytes.
So we just need to add if (laces > 1) before lace_size[n] = size - total; to solve the bof...