From 81e106306d57f9427dbf1f83cc2b24caff30bc9f Mon Sep 17 00:00:00 2001
From: uwezkhan <uwezkhan053@gmail.com>
Date: Tue, 9 Jun 2026 10:17:17 +0530
Subject: [PATCH] demux/demux_mkv: bound num_headers read in parse_vorbis_chmap

---
 demux/demux_mkv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c
index acbd75f6d929f..51e6323d30f86 100644
--- a/demux/demux_mkv.c
+++ b/demux/demux_mkv.c
@@ -1819,10 +1819,12 @@ static void parse_vorbis_chmap(struct mp_chmap *channels, unsigned char *data,
     if (size < 4)
         return;
     uint32_t vendor_length = AV_RL32(data);
-    if (vendor_length + 4 > size) // also check for the next AV_RB32 below
+    if (vendor_length + 4 > size)
         return;
     size -= vendor_length + 4;
     data += vendor_length + 4;
+    if (size < 4)
+        return;
     uint32_t num_headers = AV_RL32(data);
     size -= 4;
     data += 4;