Matroska parser breaks on parsing attached font as RAWcooked

Pull #820 added support for RAWcooked MKV attachments by indiscriminately parsing every attachment and interpreting everything as MKV elements.

If the parser finds something that looks like a very large element, it will cause a read request that exceeds EOF (which can cause a buffer overflow and crash, see issue #1030 ) and parsing will stop.

I have a simple example file that contains a font attachment that exhibits this issue.

Output of mediainfo --output=Video\;dummy --Details=1 crashfont.mkv directly before merging the pull request:

Good output

``` 00000 EBML (40 bytes) 00000 Header (5 bytes) 00000 Name: 172351395 (0xA45DFA3) 00004 Size: 35 (0x23) 00005 EBMLVersion - 1 (0x1) (4 bytes) 00005 Header (3 bytes) 00005 Name: 646 (0x0286) 00007 Size: 1 (0x01) 00008 Data: 1 (0x01) 00009 EBMLReadVersion - 1 (0x1) (4 bytes) 00009 Header (3 bytes) 00009 Name: 759 (0x02F7) 0000B Size: 1 (0x01) 0000C Data: 1 (0x01) 0000D EBMLMaxIDLength - 4 (0x4) (4 bytes) 0000D Header (3 bytes) 0000D Name: 754 (0x02F2) 0000F Size: 1 (0x01) 00010 Data: 4 (0x04) 00011 EBMLMaxSizeLength - 8 (0x8) (4 bytes) 00011 Header (3 bytes) 00011 Name: 755 (0x02F3) 00013 Size: 1 (0x01) 00014 Data: 8 (0x08) 00015 DocType - matroska (11 bytes) 00015 Header (3 bytes) 00015 Name: 642 (0x0282) 00017 Size: 8 (0x08) 00018 Data: matroska 00020 ------------------------------ 00020 --- Matroska, accepted --- 00020 ------------------------------ 00020 DocTypeVersion - 4 (0x4) (4 bytes) 00020 Header (3 bytes) 00020 Name: 647 (0x0287) 00022 Size: 1 (0x01) 00023 Data: 4 (0x04) 00024 DocTypeReadVersion - 2 (0x2) (4 bytes) 00024 Header (3 bytes) 00024 Name: 645 (0x0285) 00026 Size: 1 (0x01) 00027 Data: 2 (0x02) 00028 Segment (577875 bytes) 00028 Header (12 bytes) 00028 Name: 139690087 (0x8538067) 0002C Size: 577863 (0x0000000008D147) 00034 SeekHead (82 bytes) 00034 Header (5 bytes) 00034 Name: 21863284 (0x14D9B74) 00038 Size: 77 (0x4D) 00039 Seek (15 bytes) 00039 Header (3 bytes) 00039 Name: 3515 (0x0DBB) 0003B Size: 12 (0x0C) 0003C SeekID (7 bytes) 0003C Header (3 bytes) 0003C Name: 5035 (0x13AB) 0003E Size: 4 (0x04) 0003F Data: 88713574 (0x549A966) 00043 SeekPosition - 4099 (0x1003) - 1037 (5 bytes) 00043 Header (3 bytes) 00043 Name: 5036 (0x13AC) 00045 Size: 2 (0x02) 00046 Data: 4099 (0x1003) 00048 Seek (15 bytes) 00048 Header (3 bytes) 00048 Name: 3515 (0x0DBB) 0004A Size: 12 (0x0C) 0004B SeekID (7 bytes) 0004B Header (3 bytes) 0004B Name: 5035 (0x13AB) 0004D Size: 4 (0x04) 0004E Data: 106212971 (0x654AE6B) 00052 SeekPosition - 4224 (0x1080) - 10B4 (5 bytes) 00052 Header (3 bytes) 00052 Name: 5036 (0x13AC) 00054 Size: 2 (0x02) 00055 Data: 4224 (0x1080) 00057 Seek (16 bytes) 00057 Header (3 bytes) 00057 Name: 3515 (0x0DBB) 00059 Size: 13 (0x0D) 0005A SeekID (7 bytes) 0005A Header (3 bytes) 0005A Name: 5035 (0x13AB) 0005C Size: 4 (0x04) 0005D Data: 206814059 (0xC53BB6B) 00061 SeekPosition - 577443 (0x8CFA3) - 8CFD7 (6 bytes) 00061 Header (3 bytes) 00061 Name: 5036 (0x13AC) 00063 Size: 3 (0x03) 00064 Data: 577443 (0x08CFA3) 00067 Seek (16 bytes) 00067 Header (3 bytes) 00067 Name: 3515 (0x0DBB) 00069 Size: 13 (0x0D) 0006A SeekID (7 bytes) 0006A Header (3 bytes) 0006A Name: 5035 (0x13AB) 0006C Size: 4 (0x04) 0006D Data: 39109479 (0x254C367) 00071 SeekPosition - 577466 (0x8CFBA) - 8CFEE (6 bytes) 00071 Header (3 bytes) 00071 Name: 5036 (0x13AC) 00073 Size: 3 (0x03) 00074 Data: 577466 (0x08CFBA) 00077 Seek (15 bytes) 00077 Header (3 bytes) 00077 Name: 3515 (0x0DBB) 00079 Size: 12 (0x0C) 0007A SeekID (7 bytes) 0007A Header (3 bytes) 0007A Name: 5035 (0x13AB) 0007C Size: 4 (0x04) 0007D Data: 155296873 (0x941A469) 00081 SeekPosition - 5408 (0x1520) - 1554 (5 bytes) 00081 Header (3 bytes) 00081 Name: 5036 (0x13AC) 00083 Size: 2 (0x02) 00084 Data: 5408 (0x1520) 00086 Void (4017 bytes) 00086 Header (3 bytes) 00086 Name: 108 (0x6C) 00087 Size: 4014 (0x0FAE) 00089 Data: (4014 bytes) 01037 Info (125 bytes) 01037 Header (5 bytes) 01037 Name: 88713574 (0x549A966) 0103B Size: 120 (0x78) 0103C TimecodeScale - 1000000 (0xF4240) (7 bytes) 0103C Header (4 bytes) 0103C Name: 710577 (0x0AD7B1) 0103F Size: 3 (0x03) 01040 Data: 1000000 (0x0F4240) 01043 MuxingApp - libebml v1.3.4 + libmatroska v1.4.5 (38 bytes) 01043 Header (3 bytes) 01043 Name: 3456 (0x0D80) 01045 Size: 35 (0x23) 01046 Data: libebml v1.3.4 + libmatroska v1.4.5 01069 WritingApp - mkvmerge v9.8.0 ('Kuglblids') 64bit (38 bytes) 01069 Header (3 bytes) 01069 Name: 5953 (0x1741) 0106B Size: 35 (0x23) 0106C Data: mkvmerge v9.8.0 ('Kuglblids') 64bit 0108F Duration - 100.000 (7 bytes) 0108F Header (3 bytes) 0108F Name: 1161 (0x0489) 01091 Size: 4 (0x04) 01092 Data: 100.000 01096 DateUTC - 1539999279 (0x5BCA862F) (11 bytes) 01096 Header (3 bytes) 01096 Name: 1121 (0x0461) 01098 Size: 8 (0x08) 01099 Data: 561692079000000000 (0x07CB87F849F21600) 010A1 SegmentUID - 7356561430471719868691524887903217424 (0x588D27B59859322FCD71347BA402710) (19 bytes) 010A1 Header (3 bytes) 010A1 Name: 13220 (0x33A4) 010A3 Size: 16 (0x10) 010A4 Data: 7356561430471719868691524887903217424 (0x0588D27B59859322FCD71347BA402710) 010B4 Tracks (116 bytes) 010B4 Header (5 bytes) 010B4 Name: 106212971 (0x654AE6B) 010B8 Size: 111 (0x6F) 010B9 TrackEntry (111 bytes) 010B9 Header (2 bytes) 010B9 Name: 46 (0x2E) 010BA Size: 109 (0x6D) 010BB TrackNumber - 1 (0x1) (3 bytes) 010BB Header (2 bytes) 010BB Name: 87 (0x57) 010BC Size: 1 (0x01) 010BD Data: 1 (0x01) 010BE TrackUID - 1 (0x1) (4 bytes) 010BE Header (3 bytes) 010BE Name: 13253 (0x33C5) 010C0 Size: 1 (0x01) 010C1 Data: 1 (0x01) 010C2 TrackType - 1 (0x1) (3 bytes) 010C2 Header (2 bytes) 010C2 Name: 3 (0x03) 010C3 Size: 1 (0x01) 010C4 Data: 1 (0x01) 010C5 FlagLacing - 0 (0x0) (3 bytes) 010C5 Header (2 bytes) 010C5 Name: 28 (0x1C) 010C6 Size: 1 (0x01) 010C7 Data: 0 (0x00) 010C8 CodecID - V_MPEG4/ISO/AVC (17 bytes) 010C8 Header (2 bytes) 010C8 Name: 6 (0x06) 010C9 Size: 15 (0x0F) 010CA Data: V_MPEG4/ISO/AVC 010D9 CodecPrivate (42 bytes) 010D9 Header (3 bytes) 010D9 Name: 9122 (0x23A2) 010DB Size: 39 (0x27) 010DC Specific (39 bytes) 010DC Version: 1 (0x01) 010DD Profile: 100 (0x64) 010DE Compatible profile: 0 (0x00) 010DF Level: 10 (0x0A) 010E0 Reserved: 63 (0x3F) - (6 bits) 010E0 Size of NALU length minus 1: 3 (0x3) - (2 bits) 010E1 Reserved: 7 (0x7) - (3 bits) 010E1 seq_parameter_set count: 1 (0x01) - (5 bits) 010E2 seq_parameter_set (24 bytes) 010E2 Size: 22 (0x0016) 010E4 nal_ref_idc: 3 (0x3) - (2 bits) 010E4 nal_unit_type: 7 (0x7) - (5 bits) 010E5 profile_idc: 100 (0x64) 010E6 constraints (1 bytes) 010E6 constraint_set0_flag: No 010E6 constraint_set1_flag: No 010E6 constraint_set2_flag: No 010E6 constraint_set3_flag: No 010E6 constraint_set4_flag: No 010E6 constraint_set5_flag: No 010E6 reserved_zero_2bits: 0 (0x0) 010E7 level_idc: 10 (0x0A) - (8 bits) 010E8 seq_parameter_set_id: 0 (0x0) 010E8 high profile specific (1 bytes) 010E8 chroma_format_idc: 1 (0x1) - 4:2:0 010E8 bit_depth_luma_minus8: 0 (0x0) 010E8 bit_depth_chroma_minus8: 0 (0x0) 010E8 qpprime_y_zero_transform_bypass_flag: No 010E8 seq_scaling_matrix_present_flag: No 010E9 log2_max_frame_num_minus4: 0 (0x0) 010E9 pic_order_cnt_type: 0 (0x0) 010E9 log2_max_pic_order_cnt_lsb_minus4: 2 (0x2) 010E9 max_num_ref_frames: 4 (0x4) 010EA gaps_in_frame_num_value_allowed_flag: No 010EA pic_width_in_mbs_minus1: 0 (0x0) 010EA pic_height_in_map_units_minus1: 0 (0x0) 010EA frame_mbs_only_flag: Yes 010EA direct_8x8_inference_flag: Yes 010EA frame_cropping_flag: No 010EB vui_parameters_present_flag (12 bytes) 010EB vui_parameters_present_flag: Yes 010EB aspect_ratio_info_present_flag: No 010EB overscan_info_present_flag: No 010EB video_signal_type_present_flag: No 010EB chroma_loc_info_present_flag: No 010EB timing_info_present_flag (8 bytes) 010EB timing_info_present_flag: Yes 010EB num_units_in_tick: 1 (0x00000001) - (32 bits) 010EF time_scale: 20 (0x00000014) - (32 bits) 010F3 fixed_frame_rate_flag: No 010F3 nal_hrd_parameters_present_flag: No 010F4 vcl_hrd_parameters_present_flag: No 010F4 pic_struct_present_flag: No 010F4 bitstream_restriction_flag (3 bytes) 010F4 bitstream_restriction_flag: Yes 010F4 motion_vectors_over_pic_boundaries_flag: Yes 010F4 max_bytes_per_pic_denom: 0 (0x0) 010F4 max_bits_per_mb_denom: 0 (0x0) 010F4 log2_max_mv_length_horizontal: 8 (0x08) 010F5 log2_max_mv_length_vertical: 8 (0x08) 010F6 max_num_reorder_frames: 2 (0x2) 010F7 max_dec_frame_buffering: 4 (0x4) 010FA pic_parameter_set count: 1 (0x01) 010FB pic_parameter_set (8 bytes) 010FB Size: 6 (0x0006) 010FD nal_ref_idc: 3 (0x3) - (2 bits) 010FD nal_unit_type: 8 (0x8) - (5 bits) 010FE pic_parameter_set_id: 0 (0x0) 010FE seq_parameter_set_id: 0 (0x0) 010FE entropy_coding_mode_flag: Yes 010FE bottom_field_pic_order_in_frame_present_flag: No 010FE num_slice_groups_minus1: 0 (0x0) 010FE num_ref_idx_l0_default_active_minus1: 2 (0x2) 010FF num_ref_idx_l1_default_active_minus1: 0 (0x0) 010FF weighted_pred_flag: Yes 010FF weighted_bipred_idc: 2 (0x2) - (2 bits) 010FF pic_init_qp_minus26: -3 (0xFFFFFFFD) 01100 pic_init_qs_minus26: 0 (0x0) 01100 chroma_qp_index_offset: -2 (0xFFFFFFFE) 01100 deblocking_filter_control_present_flag: Yes 01101 constrained_intra_pred_flag: No 01101 redundant_pic_cnt_present_flag: No 01101 transform_8x8_mode_flag: Yes 01101 pic_scaling_matrix_present_flag: No 01101 second_chroma_qp_index_offset: -2 (0xFFFFFFFE) 01103 ------------------------- 01103 --- AVC, accepted --- 01103 ------------------------- 01103 DefaultDuration - 100000000 (0x5F5E100) (8 bytes) 01103 Header (4 bytes) 01103 Name: 254851 (0x03E383) 01106 Size: 4 (0x04) 01107 Data: 100000000 (0x05F5E100) 0110B Language - und (7 bytes) 0110B Header (4 bytes) 0110B Name: 177564 (0x02B59C) 0110E Size: 3 (0x03) 0110F Data: und 01112 Video (22 bytes) 01112 Header (2 bytes) 01112 Name: 96 (0x60) 01113 Size: 20 (0x14) 01114 PixelWidth - 16 (0x10) (3 bytes) 01114 Header (2 bytes) 01114 Name: 48 (0x30) 01115 Size: 1 (0x01) 01116 Data: 16 (0x10) 01117 PixelHeight - 16 (0x10) (3 bytes) 01117 Header (2 bytes) 01117 Name: 58 (0x3A) 01118 Size: 1 (0x01) 01119 Data: 16 (0x10) 0111A DisplayWidth - 16 (0x10) (7 bytes) 0111A Header (3 bytes) 0111A Name: 5296 (0x14B0) 0111C Size: 4 (0x04) 0111D Data: 16 (0x00000010) 01121 DisplayHeight - 16 (0x10) (7 bytes) 01121 Header (3 bytes) 01121 Name: 5306 (0x14BA) 01123 Size: 4 (0x04) 01124 Data: 16 (0x00000010) 01128 Void (1068 bytes) 01128 Header (3 bytes) 01128 Name: 108 (0x6C) 01129 Size: 1065 (0x0429) 0112B Data: (1065 bytes) 01554 Attachments (571310 bytes) 01554 Header (7 bytes) 01554 Name: 155296873 (0x941A469) 01558 Size: 571303 (0x08B7A7) 0155B AttachedFile (571303 bytes) 0155B Header (5 bytes) 0155B Name: 8615 (0x21A7) 0155D Size: 571298 (0x08B7A2) 01560 FileName - crashfont.otf (16 bytes) 01560 Header (3 bytes) 01560 Name: 1646 (0x066E) 01562 Size: 13 (0x0D) 01563 Data: crashfont.otf 01570 FileMimeType - application/vnd.ms-opentype (30 bytes) 01570 Header (3 bytes) 01570 Name: 1632 (0x0660) 01572 Size: 27 (0x1B) 01573 Data: application/vnd.ms-opentype 0158E FileData (571241 bytes) 0158E Header (5 bytes) 0158E Name: 1628 (0x065C) 01590 Size: 571236 (0x08B764) 01593 Data: (571236 bytes) 8CCF7 FileUID - 2828125117489024848 (0x273F84CF704B0F50) (11 bytes) 8CCF7 Header (3 bytes) 8CCF7 Name: 1710 (0x06AE) 8CCF9 Size: 8 (0x08) 8CCFA Data: 2828125117489024848 (0x273F84CF704B0F50) 8CD02 Cluster (725 bytes) 8CD02 Header (6 bytes) 8CD02 Name: 256095861 (0xF43B675) 8CD06 Size: 719 (0x02CF) 8CD08 Timecode - 0 (0x0) (3 bytes) 8CD08 Header (2 bytes) 8CD08 Name: 103 (0x67) 8CD09 Size: 1 (0x01) 8CD0A Data: 0 (0x00) 8CD0B SimpleBlock - 1 (0x1) - 0 (0x0) (716 bytes) 8CD0B Header (3 bytes) 8CD0B Name: 35 (0x23) 8CD0C Size: 713 (0x02C9) 8CD0E TrackNumber: 1 (0x01) 8CD0F TimeCode: 0 (0x0000) 8CD11 Flags (1 bytes) 8CD11 KeyFrame: 1 (0x1) 8CD11 Reserved: 0 (0x0) 8CD11 Invisible: 0 (0x0) 8CD11 Lacing: 0 (0x0) 8CD11 Discardable: 0 (0x0) 8CD12 Data - Parser=AVC (709 bytes) 8CD12 sei (690 bytes) 8CD12 Header (5 bytes) 8CD12 size: 686 (0x000002AE) 8CD16 nal_ref_idc: 0 (0x0) - (2 bits) 8CD16 nal_unit_type: 6 (0x06) - (5 bits) 8CD17 sei message - user_data_unregistered - x264 (684 bytes) 8CD17 sei message header (4 bytes) 8CD17 payload_type_byte: 5 (0x05) 8CD18 payload_size_byte: 255 (0xFF) 8CD19 payload_size_byte: 255 (0xFF) 8CD1A payload_size_byte: 170 (0xAA) 8CD1B uuid_iso_iec_11578: DC45E9BD-E6D9-48B7-962C-D820D923EEEF 8CD2B data: x264 8CD2F separator: - 8CD32 data: core 148 r2748 97eaef2 8CD48 separator: - 8CD4B data: H.264/MPEG-4 AVC codec 8CD61 separator: - 8CD64 data: Copyleft 2003-2016 8CD76 separator: - 8CD79 data: http://www.videolan.org/x264.html 8CD9A separator: - 8CD9D options (549 bytes) 8CD9D option: options: 8CDA5 separator: 8CDA6 option: cabac=1 8CDAD separator: 8CDAE option: ref=3 8CDB3 separator: 8CDB4 option: deblock=1:0:0 8CDC1 separator: 8CDC2 option: analyse=0x3:0x113 8CDD3 separator: 8CDD4 option: me=hex 8CDDA separator: 8CDDB option: subme=7 8CDE2 separator: 8CDE3 option: psy=1 8CDE8 separator: 8CDE9 option: psy_rd=1.00:0.00 8CDF9 separator: 8CDFA option: mixed_ref=1 8CE05 separator: 8CE06 option: me_range=16 8CE11 separator: 8CE12 option: chroma_me=1 8CE1D separator: 8CE1E option: trellis=1 8CE27 separator: 8CE28 option: 8x8dct=1 8CE30 separator: 8CE31 option: cqm=0 8CE36 separator: 8CE37 option: deadzone=21,11 8CE45 separator: 8CE46 option: fast_pskip=1 8CE52 separator: 8CE53 option: chroma_qp_offset=-2 8CE66 separator: 8CE67 option: threads=1 8CE70 separator: 8CE71 option: lookahead_threads=1 8CE84 separator: 8CE85 option: sliced_threads=0 8CE95 separator: 8CE96 option: nr=0 8CE9A separator: 8CE9B option: decimate=1 8CEA5 separator: 8CEA6 option: interlaced=0 8CEB2 separator: 8CEB3 option: bluray_compat=0 8CEC2 separator: 8CEC3 option: constrained_intra=0 8CED6 separator: 8CED7 option: bframes=3 8CEE0 separator: 8CEE1 option: b_pyramid=2 8CEEC separator: 8CEED option: b_adapt=1 8CEF6 separator: 8CEF7 option: b_bias=0 8CEFF separator: 8CF00 option: direct=1 8CF08 separator: 8CF09 option: weightb=1 8CF12 separator: 8CF13 option: open_gop=0 8CF1D separator: 8CF1E option: weightp=2 8CF27 separator: 8CF28 option: keyint=250 8CF32 separator: 8CF33 option: keyint_min=10 8CF40 separator: 8CF41 option: scenecut=40 8CF4C separator: 8CF4D option: intra_refresh=0 8CF5C separator: 8CF5D option: rc_lookahead=40 8CF6C separator: 8CF6D option: rc=crf 8CF73 separator: 8CF74 option: mbtree=1 8CF7C separator: 8CF7D option: crf=23.0 8CF85 separator: 8CF86 option: qcomp=0.60 8CF90 separator: 8CF91 option: qpmin=0 8CF98 separator: 8CF99 option: qpmax=69 8CFA1 separator: 8CFA2 option: qpstep=4 8CFAA separator: 8CFAB option: ip_ratio=1.40 8CFB8 separator: 8CFB9 option: aq=1:1.00 8CFC4 slice_layer_without_partitioning (IDR) - 0 - Frame 0 - slice_type I - frame_num 0 - pic_order_cnt_lsb 0 (19 bytes) 8CFC4 Header (5 bytes) 8CFC4 size: 15 (0x0000000F) 8CFC8 nal_ref_idc: 3 (0x3) - (2 bits) 8CFC8 nal_unit_type: 5 (0x05) - (5 bits) 8CFC9 slice_header (4 bytes) 8CFC9 first_mb_in_slice: 0 (0x0) 8CFC9 slice_type: 7 (0x07) - I 8CFCA pic_parameter_set_id: 0 (0x0) 8CFCA frame_num: 0 (0x0) 8CFCA idr_pic_id: 0 (0x0) 8CFCA pic_order_cnt_lsb: 0 (0x00) 8CFCB no_output_of_prior_pics_flag: No 8CFCB long_term_reference_flag: No 8CFCB slice_qp_delta: -13 (0xFFFFFFF3) 8CFCD disable_deblocking_filter_idc: 0 (0x0) 8CFCD slice_alpha_c0_offset_div2: 0 (0x0) 8CFCD slice_beta_offset_div2: 0 (0x0) 8CFCD slice_data (8 bytes) 8CFCD (ToDo): (Data) 8CFD7 Cues (23 bytes) 8CFD7 Header (5 bytes) 8CFD7 Name: 206814059 (0xC53BB6B) 8CFDB Size: 18 (0x12) 8CFDC CuePoint (18 bytes) 8CFDC Header (2 bytes) 8CFDC Name: 59 (0x3B) 8CFDD Size: 16 (0x10) 8CFDE CueTime - 0 (0x0) (3 bytes) 8CFDE Header (2 bytes) 8CFDE Name: 51 (0x33) 8CFDF Size: 1 (0x01) 8CFE0 Data: 0 (0x00) 8CFE1 CueTrackPositions (13 bytes) 8CFE1 Header (2 bytes) 8CFE1 Name: 55 (0x37) 8CFE2 Size: 11 (0x0B) 8CFE3 CueTrack - 1 (0x1) (3 bytes) 8CFE3 Header (2 bytes) 8CFE3 Name: 119 (0x77) 8CFE4 Size: 1 (0x01) 8CFE5 Data: 1 (0x01) 8CFE6 CueClusterPosition - 576718 (0x8CCCE) (5 bytes) 8CFE6 Header (2 bytes) 8CFE6 Name: 113 (0x71) 8CFE7 Size: 3 (0x03) 8CFE8 Data: 576718 (0x08CCCE) 8CFEB CueRelativePosition - 3 (0x3) (3 bytes) 8CFEB Header (2 bytes) 8CFEB Name: 112 (0x70) 8CFEC Size: 1 (0x01) 8CFED Data: 3 (0x03) 8CFEE Tags (397 bytes) 8CFEE Header (6 bytes) 8CFEE Name: 39109479 (0x254C367) 8CFF2 Size: 391 (0x0187) 8CFF4 Tag (391 bytes) 8CFF4 Header (4 bytes) 8CFF4 Name: 13171 (0x3373) 8CFF6 Size: 387 (0x0183) 8CFF8 Targets (19 bytes) 8CFF8 Header (3 bytes) 8CFF8 Name: 9152 (0x23C0) 8CFFA Size: 16 (0x10) 8CFFB TargetTypeValue - 50 (0x32) (4 bytes) 8CFFB Header (3 bytes) 8CFFB Name: 10442 (0x28CA) 8CFFD Size: 1 (0x01) 8CFFE Data: 50 (0x32) 8CFFF TagTrackUID - 1 (0x1) (4 bytes) 8CFFF Header (3 bytes) 8CFFF Name: 9157 (0x23C5) 8D001 Size: 1 (0x01) 8D002 Data: 1 (0x01) 8D003 TargetType - MOVIE (8 bytes) 8D003 Header (3 bytes) 8D003 Name: 9162 (0x23CA) 8D005 Size: 5 (0x05) 8D006 Data: MOVIE 8D00B SimpleTag (27 bytes) 8D00B Header (3 bytes) 8D00B Name: 10184 (0x27C8) 8D00D Size: 24 (0x18) 8D00E TagName - BPS (6 bytes) 8D00E Header (3 bytes) 8D00E Name: 1443 (0x05A3) 8D010 Size: 3 (0x03) 8D011 Data: BPS 8D014 TagLanguage - eng (6 bytes) 8D014 Header (3 bytes) 8D014 Name: 1146 (0x047A) 8D016 Size: 3 (0x03) 8D017 Data: eng 8D01A TagDefault - 1 (0x1) (4 bytes) 8D01A Header (3 bytes) 8D01A Name: 1156 (0x0484) 8D01C Size: 1 (0x01) 8D01D Data: 1 (0x01) 8D01E TagString - 56720 (8 bytes) 8D01E Header (3 bytes) 8D01E Name: 1159 (0x0487) 8D020 Size: 5 (0x05) 8D021 Data: 56720 8D026 SimpleTag (45 bytes) 8D026 Header (3 bytes) 8D026 Name: 10184 (0x27C8) 8D028 Size: 42 (0x2A) 8D029 TagName - DURATION (11 bytes) 8D029 Header (3 bytes) 8D029 Name: 1443 (0x05A3) 8D02B Size: 8 (0x08) 8D02C Data: DURATION 8D034 TagLanguage - eng (6 bytes) 8D034 Header (3 bytes) 8D034 Name: 1146 (0x047A) 8D036 Size: 3 (0x03) 8D037 Data: eng 8D03A TagDefault - 1 (0x1) (4 bytes) 8D03A Header (3 bytes) 8D03A Name: 1156 (0x0484) 8D03C Size: 1 (0x01) 8D03D Data: 1 (0x01) 8D03E TagString - 00:00:00.100000000 (21 bytes) 8D03E Header (3 bytes) 8D03E Name: 1159 (0x0487) 8D040 Size: 18 (0x12) 8D041 Data: 00:00:00.100000000 8D053 SimpleTag (36 bytes) 8D053 Header (3 bytes) 8D053 Name: 10184 (0x27C8) 8D055 Size: 33 (0x21) 8D056 TagName - NUMBER_OF_FRAMES (19 bytes) 8D056 Header (3 bytes) 8D056 Name: 1443 (0x05A3) 8D058 Size: 16 (0x10) 8D059 Data: NUMBER_OF_FRAMES 8D069 TagLanguage - eng (6 bytes) 8D069 Header (3 bytes) 8D069 Name: 1146 (0x047A) 8D06B Size: 3 (0x03) 8D06C Data: eng 8D06F TagDefault - 1 (0x1) (4 bytes) 8D06F Header (3 bytes) 8D06F Name: 1156 (0x0484) 8D071 Size: 1 (0x01) 8D072 Data: 1 (0x01) 8D073 TagString - 1 (4 bytes) 8D073 Header (3 bytes) 8D073 Name: 1159 (0x0487) 8D075 Size: 1 (0x01) 8D076 Data: 1 8D077 SimpleTag (37 bytes) 8D077 Header (3 bytes) 8D077 Name: 10184 (0x27C8) 8D079 Size: 34 (0x22) 8D07A TagName - NUMBER_OF_BYTES (18 bytes) 8D07A Header (3 bytes) 8D07A Name: 1443 (0x05A3) 8D07C Size: 15 (0x0F) 8D07D Data: NUMBER_OF_BYTES 8D08C TagLanguage - eng (6 bytes) 8D08C Header (3 bytes) 8D08C Name: 1146 (0x047A) 8D08E Size: 3 (0x03) 8D08F Data: eng 8D092 TagDefault - 1 (0x1) (4 bytes) 8D092 Header (3 bytes) 8D092 Name: 1156 (0x0484) 8D094 Size: 1 (0x01) 8D095 Data: 1 (0x01) 8D096 TagString - 709 (6 bytes) 8D096 Header (3 bytes) 8D096 Name: 1159 (0x0487) 8D098 Size: 3 (0x03) 8D099 Data: 709 8D09C SimpleTag (77 bytes) 8D09C Header (3 bytes) 8D09C Name: 10184 (0x27C8) 8D09E Size: 74 (0x4A) 8D09F TagName - _STATISTICS_WRITING_APP (26 bytes) 8D09F Header (3 bytes) 8D09F Name: 1443 (0x05A3) 8D0A1 Size: 23 (0x17) 8D0A2 Data: _STATISTICS_WRITING_APP 8D0B9 TagLanguage - eng (6 bytes) 8D0B9 Header (3 bytes) 8D0B9 Name: 1146 (0x047A) 8D0BB Size: 3 (0x03) 8D0BC Data: eng 8D0BF TagDefault - 1 (0x1) (4 bytes) 8D0BF Header (3 bytes) 8D0BF Name: 1156 (0x0484) 8D0C1 Size: 1 (0x01) 8D0C2 Data: 1 (0x01) 8D0C3 TagString - mkvmerge v9.8.0 ('Kuglblids') 64bit (38 bytes) 8D0C3 Header (3 bytes) 8D0C3 Name: 1159 (0x0487) 8D0C5 Size: 35 (0x23) 8D0C6 Data: mkvmerge v9.8.0 ('Kuglblids') 64bit 8D0E9 SimpleTag (66 bytes) 8D0E9 Header (3 bytes) 8D0E9 Name: 10184 (0x27C8) 8D0EB Size: 63 (0x3F) 8D0EC TagName - _STATISTICS_WRITING_DATE_UTC (31 bytes) 8D0EC Header (3 bytes) 8D0EC Name: 1443 (0x05A3) 8D0EE Size: 28 (0x1C) 8D0EF Data: _STATISTICS_WRITING_DATE_UTC 8D10B TagLanguage - eng (6 bytes) 8D10B Header (3 bytes) 8D10B Name: 1146 (0x047A) 8D10D Size: 3 (0x03) 8D10E Data: eng 8D111 TagDefault - 1 (0x1) (4 bytes) 8D111 Header (3 bytes) 8D111 Name: 1156 (0x0484) 8D113 Size: 1 (0x01) 8D114 Data: 1 (0x01) 8D115 TagString - 2018-10-20 01:34:39 (22 bytes) 8D115 Header (3 bytes) 8D115 Name: 1159 (0x0487) 8D117 Size: 19 (0x13) 8D118 Data: 2018-10-20 01:34:39 8D12B SimpleTag (80 bytes) 8D12B Header (3 bytes) 8D12B Name: 10184 (0x27C8) 8D12D Size: 77 (0x4D) 8D12E TagName - _STATISTICS_TAGS (19 bytes) 8D12E Header (3 bytes) 8D12E Name: 1443 (0x05A3) 8D130 Size: 16 (0x10) 8D131 Data: _STATISTICS_TAGS 8D141 TagLanguage - eng (6 bytes) 8D141 Header (3 bytes) 8D141 Name: 1146 (0x047A) 8D143 Size: 3 (0x03) 8D144 Data: eng 8D147 TagDefault - 1 (0x1) (4 bytes) 8D147 Header (3 bytes) 8D147 Name: 1156 (0x0484) 8D149 Size: 1 (0x01) 8D14A Data: 1 (0x01) 8D14B TagString - BPS DURATION NUMBER_OF_FRAMES NUMBER_OF_BYTES (48 bytes) 8D14B Header (3 bytes) 8D14B Name: 1159 (0x0487) 8D14D Size: 45 (0x2D) 8D14E Data: BPS DURATION NUMBER_OF_FRAMES NUMBER_OF_BYTES 8D17B ----------------------------- 8D17B --- Matroska, filling --- 8D17B ----------------------------- 8D17B ------------------------------ 8D17B --- Matroska, finished --- 8D17B ------------------------------ ```

There’s an AttachedFile element (571303 bytes) at offset 0155B, which includes a FileData element (571241 bytes) at offset 0158E. More information about the video stream follows.

Output of mediainfo --output=Video\;dummy --Details=1 crashfont.mkv directly after merging the pull request:

Bad output

The AttachedFile element at offset 0155B is supposedly only 5267 bytes even though the size at 0155D says 571298. The FileData element at offset 0158E is only 5216 bytes instead of 5+571236. Afterwards, there’s only one bogus F54 element, then the parser aborts.

Adding some debug code to File_Mk::Header_Parse() shows that the next element supposedly has name 35 and size 476104909640963 (≈433 TiB). A read request for that obviously cannot be satisfied.

When attachment parsing is disabled by replacing Element_ThisIsAList(); in File_Mk::Segment_Attachments_AttachedFile_FileData() with Skip_XX(Element_TotalSize_Get(), "Data");, the file is parsed as expected.

MediaArea / MediaInfoLib

Matroska parser breaks on parsing attached font as RAWcooked #1029