player/loadfile: fix stack-overflow on EDL metadata track
demux_edl allocates metadata track with type set to STREAM_TYPE_COUNT, when counting track types this was not accounted for. Make room for this "special" type of track. Add asserts while at it, just in case. Note that other similar uses are gated behind track->selected, and metadata track will never be marked as one. This is not exploitable, as it was overriding only one integer value past the allocated array, so worse thing that could happen is that we misbehave during track selection or crash. Side note, OSS-Fuzz was fuzzing this for few years now, and couldn't dig into this specific case. I've validated that our fuzzer is in fact reproducing this issue when provided the testcase, which I belive was a basis for this report. Fixes: GHSA-qpf4-42gw-f286 This vulnerability was discovered by Claude, Anthropic's AI assistant, with OSS-Fuzz fuzzing and triaged by Ada Logics manually in collaboration with Anthropic Research.
K
Kacper Michajłow committed
6bdacac99153b5a487d108e11d2f8d7678afd2fd
Parent: 7732c30