From 19c64ffd2681cb084e2ee76ee92af6f135f53854 Mon Sep 17 00:00:00 2001 From: Miklos Juhasz Date: Mon, 1 Jun 2026 16:18:39 +0200 Subject: [PATCH 1/2] x DTS: fix infinite loop in Extensions() when handler overflows asset boundary XLL() temporarily expands Element_Size to cover the full XLL frame. If parsing fails inside XLL(), Trusted_IsNot() fires and sets Element_Offset=Element_Size (the expanded value). XLL() then restores Element_Size=Element_Size_Save (the smaller outer asset boundary), leaving Element_Offset>Element_Size. The unsigned subtraction in the while-loop condition wraps around, making the loop run forever. Reproducible: MKV file with DTS-HD MA audio and any attached file (e.g. SRT). The hang was introduced when commit 892a9a6 restored the Skip_XX integrity check, enabling the Trusted_IsNot() code path for the first time. --- Source/MediaInfo/Audio/File_Dts.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Source/MediaInfo/Audio/File_Dts.cpp b/Source/MediaInfo/Audio/File_Dts.cpp index bc8990678a..801cca8df7 100644 --- a/Source/MediaInfo/Audio/File_Dts.cpp +++ b/Source/MediaInfo/Audio/File_Dts.cpp @@ -1692,6 +1692,8 @@ void File_Dts::Extensions() default: Extensions_Resynch(false); } + if (Element_Offset>Element_Size) + Element_Offset=Element_Size; //Prevent unsigned underflow in loop condition if handler left offset past asset boundary Element_End0(); } Element_Size=Element_Size_Save; From ebf652c9a143b334c06245f1ec70f81b95a0f229 Mon Sep 17 00:00:00 2001 From: Miklos Juhasz Date: Thu, 4 Jun 2026 11:42:27 +0200 Subject: [PATCH 2/2] x DTS/XLL: fix root cause of Element_Offset overshoot when LLFrameSize exceeds asset boundary When the declared XLL logical frame size (LLFrameSize) exceeds the remaining bytes in the current ExSS asset, XLL() was unconditionally expanding Element_Size beyond the actual buffer boundary. Subsequent Skip_XX calls then triggered the INTEGRITY_SIZE_ATLEAST integrity check (restored by 892a9a6), which called Trusted_IsNot() and set Element_Offset = Element_Size (the oversized value). When XLL() restored Element_Size to the outer asset boundary, Element_Offset was left far past it, causing the unsigned underflow and infinite loop in Extensions(). Add a bounds check before expanding Element_Size: if the computed XLL frame end exceeds the current asset boundary, unwind the parser state (BS_End + Element_End0) and skip to the end of the asset, mirroring the existing LLFrameSize < 6 guard pattern directly above. --- Source/MediaInfo/Audio/File_Dts.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Source/MediaInfo/Audio/File_Dts.cpp b/Source/MediaInfo/Audio/File_Dts.cpp index 801cca8df7..cf79f95f38 100644 --- a/Source/MediaInfo/Audio/File_Dts.cpp +++ b/Source/MediaInfo/Audio/File_Dts.cpp @@ -1948,6 +1948,13 @@ void File_Dts::XLL() return; } auto Element_Size_Save=Element_Size; + if (Element_Offset_Start-3+LLFrameSize>Element_Size_Save) + { + BS_End(); + Element_End0(); + Skip_XX(Element_Size-Element_Offset, "(Unknown)"); + return; + } Element_Size=Element_Offset_Start-3+LLFrameSize; Get_S1 (4, NumChSetsInFrame, "NumChSetsInFrame"); NumChSetsInFrame++; Param_Info1(NumChSetsInFrame);