SIGN IN SIGN UP

player/loadfile: fix stack-overflow on EDL metadata track

demux_edl allocates metadata track with type set to STREAM_TYPE_COUNT,
when counting track types this was not accounted for. Make room for this
"special" type of track. Add asserts while at it, just in case.

Note that other similar uses are gated behind track->selected, and
metadata track will never be marked as one.

This is not exploitable, as it was overriding only one integer value past
the allocated array, so worse thing that could happen is that we
misbehave during track selection or crash.

Side note, OSS-Fuzz was fuzzing this for few years now, and couldn't dig
into this specific case. I've validated that our fuzzer is in fact
reproducing this issue when provided the testcase, which I belive was a
basis for this report.

Fixes: GHSA-qpf4-42gw-f286

This vulnerability was discovered by Claude, Anthropic's AI assistant,
with OSS-Fuzz fuzzing and triaged by Ada Logics manually in
collaboration with Anthropic Research.
K
Kacper Michajłow committed
6bdacac99153b5a487d108e11d2f8d7678afd2fd
Parent: 7732c30