Version in base suite: 92.0-1 Base version: mkvtoolnix_92.0-1 Target version: mkvtoolnix_92.0-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/m/mkvtoolnix/mkvtoolnix_92.0-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/m/mkvtoolnix/mkvtoolnix_92.0-1+deb13u1.dsc changelog | 6 patches/CVE-2026-90783.patch | 402 +++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 409 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpcvw7mtcr/mkvtoolnix_92.0-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpcvw7mtcr/mkvtoolnix_92.0-1+deb13u1.dsc: no acceptable signature found diff -Nru mkvtoolnix-92.0/debian/changelog mkvtoolnix-92.0/debian/changelog --- mkvtoolnix-92.0/debian/changelog 2025-04-27 08:14:15.000000000 +0000 +++ mkvtoolnix-92.0/debian/changelog 2026-09-14 18:31:08.000000000 +0000 @@ -1,3 +1,9 @@ +mkvtoolnix (92.0-1+deb13u1) trixie-security; urgency=medium + + * CVE-2026-90783 (Closes: #1147621) + + -- Moritz Mühlenhoff Mon, 14 Sep 2026 20:31:08 +0200 + mkvtoolnix (92.0-1) unstable; urgency=medium * New upstream release. diff -Nru mkvtoolnix-92.0/debian/patches/CVE-2026-90783.patch mkvtoolnix-92.0/debian/patches/CVE-2026-90783.patch --- mkvtoolnix-92.0/debian/patches/CVE-2026-90783.patch 1970-01-01 00:00:00.000000000 +0000 +++ mkvtoolnix-92.0/debian/patches/CVE-2026-90783.patch 2026-09-14 07:07:38.000000000 +0000 @@ -0,0 +1,402 @@ +From 13fd81db3ae2b79d41536a9663719df11780797e Mon Sep 17 00:00:00 2001 +From: Moritz Bunkus +Date: Tue, 25 Aug 2026 11:50:45 +0200 +Subject: [PATCH] avilib: guard against memory allocation failures + +From 1495126138e086080f0163bee27fafbdf956a1d0 Mon Sep 17 00:00:00 2001 +From: Moritz Bunkus +Date: Tue, 25 Aug 2026 13:01:14 +0200 +Subject: [PATCH] avilib: guard against heap overflow due to integer + multiplication wrapping + +--- mkvtoolnix-92.0.orig/lib/avilib-0.6.10/avilib.c ++++ mkvtoolnix-92.0/lib/avilib-0.6.10/avilib.c +@@ -37,6 +37,42 @@ + + #include "xio.h" + ++#define safecalloc(n, size) _safecalloc(n, size, __LINE__) ++ ++static void *_safecalloc(size_t n, size_t size, int line) { ++ void *mem = calloc(n, size); ++ if (!mem) { ++ fprintf(stderr, "avilib.c/_safecalloc() called from line %d: calloc(%zu, %zu) returned nullptr for a size of %llu bytes.\n", line, n, size, (unsigned long long)n * (unsigned long long)size); ++ exit(2); ++ } ++ ++ return mem; ++} ++ ++#define saferealloc(p, size) _saferealloc(p, size, __LINE__) ++ ++static void *_saferealloc(void *p, size_t size, int line) { ++ void *mem = realloc(p, size); ++ if (!mem) { ++ fprintf(stderr, "avilib.c/_saferealloc() called from line %d: realloc(%p, %zu) returned nullptr.\n", line, p, size); ++ exit(2); ++ } ++ ++ return mem; ++} ++ ++#define safemulu(a, b) _safemulu(a, b, __LINE__) ++static size_t _safemulu(size_t a, size_t b, int line) { ++ size_t result = 0; ++ ++ if (__builtin_mul_overflow(a, b, &result)) { ++ fprintf(stderr, "avilib.c/_safemulu() called from line %d: __builtin_mul_overflow(%zu, %zu) indicated an overflow.\n", line, a, b); ++ exit(2); ++ } ++ ++ return result; ++} ++ + #if defined(COMP_MSC) || defined(COMP_MINGW) + # define snprintf _snprintf + # define strtoll(x,y,z) _atoi64(x) +@@ -250,8 +286,14 @@ static int avi_add_chunk(avi_t *AVI, voi + static int avi_ixnn_entry(avi_t *AVI, avistdindex_chunk *ch, avisuperindex_entry *en) + { + int bl, k; +- unsigned int max = ch->nEntriesInUse * sizeof (uint32_t) * ch->wLongsPerEntry + 24; // header +- char *ix00 = calloc(1, max); ++ size_t max = safemulu(ch->nEntriesInUse, sizeof (uint32_t) * ch->wLongsPerEntry) + 24; // header ++ ++ if (max >= (1ull << 32)) { ++ fprintf(stderr, "avilib.c/avi_ixnn_entry: aborting due to 32-bit integer overflow detection for index entry size\n"); ++ exit(2); ++ } ++ ++ char *ix00 = safecalloc(1, max); + char dfcc[5]; + memcpy (dfcc, ch->fcc, 4); + dfcc[4] = 0; +@@ -302,7 +344,7 @@ static int avi_init_super_index(avi_t *A + + avisuperindex_chunk *sil = NULL; + +- if ((sil = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk))) == NULL) { ++ if ((sil = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk))) == NULL) { + AVI_errno = AVI_ERR_NO_MEM; + return -1; + } +@@ -316,20 +358,20 @@ static int avi_init_super_index(avi_t *A + memset (sil->dwReserved, 0, sizeof (sil->dwReserved)); + + // NR_IXNN_CHUNKS == allow 1024 indices which means 1024 GB files -- arbitrary +- sil->aIndex = calloc(1, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); ++ sil->aIndex = safecalloc(1, (size_t)sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); + if (!sil->aIndex) { + AVI_errno = AVI_ERR_NO_MEM; + return -1; + } +- memset (sil->aIndex, 0, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); ++ memset (sil->aIndex, 0, (size_t)sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); + +- sil->stdindex = calloc(1, NR_IXNN_CHUNKS * sizeof (avistdindex_chunk *)); ++ sil->stdindex = safecalloc(1, NR_IXNN_CHUNKS * sizeof (avistdindex_chunk *)); + if (!sil->stdindex) { + AVI_errno = AVI_ERR_NO_MEM; + return -1; + } + for (k = 0; k < NR_IXNN_CHUNKS; k++) { +- sil->stdindex[k] = calloc(1, sizeof (avistdindex_chunk)); ++ sil->stdindex[k] = safecalloc(1, sizeof (avistdindex_chunk)); + // gets rewritten later + sil->stdindex[k]->qwBaseOffset = (uint64_t)k * NEW_RIFF_THRES; + } +@@ -357,7 +399,7 @@ static int avi_add_std_index(avi_t *AVI, + + //stdil->qwBaseOffset = AVI->video_superindex->aIndex[ cur_std_idx ]->qwOffset; + +- stdil->aIndex = calloc(1, stdil->dwSize * sizeof (uint32_t) * stdil->wLongsPerEntry); ++ stdil->aIndex = safecalloc(1, safemulu(stdil->dwSize, sizeof (uint32_t) * stdil->wLongsPerEntry)); + + if (!stdil->aIndex) { + AVI_errno = AVI_ERR_NO_MEM; +@@ -378,7 +420,7 @@ static int avi_add_odml_index_entry_core + // need to fetch more memory + if (cur_chunk_idx >= si->dwSize) { + si->dwSize += 4096; +- si->aIndex = realloc ( si->aIndex, si->dwSize * sizeof (uint32_t) * si->wLongsPerEntry); ++ si->aIndex = saferealloc ( si->aIndex, safemulu(si->dwSize, sizeof (uint32_t) * si->wLongsPerEntry)); + } + + if(len>AVI->max_len) AVI->max_len=len; +@@ -577,8 +619,8 @@ static int avi_add_index_entry(avi_t *AV + void *ptr; + + if(!AVI->idx || (AVI->n_idx>=AVI->max_idx)) { +- ptr = realloc((void *)AVI->idx,(AVI->max_idx+4096)*16); +- ++ ptr = saferealloc((void *)AVI->idx,(AVI->max_idx+4096)*16); ++ + if(ptr == 0) { + AVI_errno = AVI_ERR_NO_MEM; + return -1; +@@ -656,7 +698,7 @@ avi_t* AVI_open_output_file(void * filen + + /* Allocate the avi_t struct and zero it */ + +- AVI = (avi_t *) calloc(1, sizeof(avi_t)); ++ AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); + if(AVI==0) + { + AVI_errno = AVI_ERR_NO_MEM; +@@ -1075,7 +1117,7 @@ static int avi_parse_comments (int fd, c + return -1; + } + +- if ( !(data = calloc(1, st.st_size*sizeof(char)+1)) ) { ++ if ( !(data = safecalloc(1, st.st_size*sizeof(char)+1)) ) { + fprintf(stderr, "calloc failed\n"); + return -1; + } +@@ -2007,7 +2049,7 @@ avi_t *AVI_open_input_indexfile(void *fi + + /* Create avi_t structure */ + +- AVI = (avi_t *) calloc(1, sizeof(avi_t)); ++ AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); + if(AVI==NULL) + { + AVI_errno = AVI_ERR_NO_MEM; +@@ -2051,7 +2093,7 @@ avi_t *AVI_open_indexfd(int fd, int getI + + /* Create avi_t structure */ + +- AVI = (avi_t *) calloc(1, sizeof(avi_t)); ++ AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); + if(AVI==NULL) + { + AVI_errno = AVI_ERR_NO_MEM; +@@ -2085,7 +2127,7 @@ avi_t *AVI_open_input_file(void *filenam + + /* Create avi_t structure */ + +- AVI = (avi_t *) calloc(1, sizeof(avi_t)); ++ AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); + if(AVI==NULL) + { + AVI_errno = AVI_ERR_NO_MEM; +@@ -2124,7 +2166,7 @@ avi_t *AVI_open_fd(int fd, int getIndex) + + /* Create avi_t structure */ + +- AVI = (avi_t *) calloc(1, sizeof(avi_t)); ++ AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); + if(AVI==NULL) + { + AVI_errno = AVI_ERR_NO_MEM; +@@ -2213,12 +2255,12 @@ int avi_parse_index_from_file(avi_t *AVI + for(j=0; janum; ++j) AVI->track[j].audio_chunks = aud_chunks[j]; + + if(AVI->video_frames==0) ERR_EXIT(AVI_ERR_NO_VIDS); +- AVI->video_index = (video_index_entry *) calloc(1, vid_chunks*sizeof(video_index_entry)); ++ AVI->video_index = (video_index_entry *) safecalloc(1, vid_chunks*sizeof(video_index_entry)); + if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + + for(j=0; janum; ++j) { + if(AVI->track[j].audio_chunks) { +- AVI->track[j].audio_index = (audio_index_entry *) calloc(1, aud_chunks[j]*sizeof(audio_index_entry)); ++ AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, aud_chunks[j]*sizeof(audio_index_entry)); + if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + } + } +@@ -2324,7 +2366,7 @@ int avi_parse_input_file(avi_t *AVI, int + if(strncasecmp(data,"hdrl",4) == 0) + { + hdrl_len = n; +- hdrl_data = (unsigned char *) calloc(1, n); ++ hdrl_data = (unsigned char *) safecalloc(1, n); + if(hdrl_data==0) ERR_EXIT(AVI_ERR_NO_MEM); + + // offset of header +@@ -2347,7 +2389,7 @@ int avi_parse_input_file(avi_t *AVI, int + break if this is not the case */ + + AVI->n_idx = AVI->max_idx = n/16; +- AVI->idx = (unsigned char((*)[16]) ) calloc(1, n); ++ AVI->idx = (unsigned char((*)[16]) ) safecalloc(1, n); + if(AVI->idx==0) ERR_EXIT(AVI_ERR_NO_MEM) + if(avi_read(AVI->fdes, (char *) AVI->idx, n) != n ) { + free ( AVI->idx); AVI->idx=NULL; +@@ -2465,7 +2507,7 @@ int avi_parse_input_file(avi_t *AVI, int + if(lasttag == 1) + { + uint32_t ck_size = str2ulong(hdrl_data + i - 4); +- AVI->bitmap_info_header = (alBITMAPINFOHEADER *)calloc(1, ck_size); ++ AVI->bitmap_info_header = (alBITMAPINFOHEADER *)safecalloc(1, ck_size); + if (AVI->bitmap_info_header != NULL) { + memcpy(AVI->bitmap_info_header, hdrl_data + i, ck_size); + long2str(&AVI->bitmap_info_header->bi_size, +@@ -2493,13 +2535,13 @@ int avi_parse_input_file(avi_t *AVI, int + wfes = hdrl_len - i; + else + wfes = sizeof(alWAVEFORMATEX); +- wfe = (alWAVEFORMATEX *)calloc(1, sizeof(alWAVEFORMATEX)); ++ wfe = (alWAVEFORMATEX *)safecalloc(1, sizeof(alWAVEFORMATEX)); + if (wfe != NULL) { + memset(wfe, 0, sizeof(alWAVEFORMATEX)); + memcpy(wfe, hdrl_data + i, wfes); + if (str2ushort((unsigned char *)&wfe->cb_size) != 0) { + nwfe = (char *) +- realloc(wfe, sizeof(alWAVEFORMATEX) + ++ saferealloc(wfe, sizeof(alWAVEFORMATEX) + + str2ushort((unsigned char *)&wfe->cb_size)); + if (nwfe != 0) { + int64_t lpos = xio_lseek(AVI->fdes, 0, SEEK_CUR); +@@ -2537,7 +2579,7 @@ int avi_parse_input_file(avi_t *AVI, int + + a = (char *)(hdrl_data+i); + +- AVI->video_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); ++ AVI->video_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); + memcpy (AVI->video_superindex->fcc, a, 4); a += 4; + AVI->video_superindex->dwSize = str2ulong(a); a += 4; + AVI->video_superindex->wLongsPerEntry = str2ushort(a); a += 2; +@@ -2552,7 +2594,7 @@ int avi_parse_input_file(avi_t *AVI, int + if (AVI->video_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } + + AVI->video_superindex->aIndex = +- calloc(1, AVI->video_superindex->wLongsPerEntry * AVI->video_superindex->nEntriesInUse * sizeof (uint32_t)); ++ safecalloc(1, safemulu(sizeof(uint32_t) * AVI->video_superindex->wLongsPerEntry, AVI->video_superindex->nEntriesInUse)); + + // position of ix## chunks + for (j=0; jvideo_superindex->nEntriesInUse; ++j) { +@@ -2590,7 +2632,7 @@ int avi_parse_input_file(avi_t *AVI, int + + a = (char *)(hdrl_data+i); + +- AVI->track[AVI->aptr].audio_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); ++ AVI->track[AVI->aptr].audio_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); + memcpy (AVI->track[AVI->aptr].audio_superindex->fcc, a, 4); a += 4; + AVI->track[AVI->aptr].audio_superindex->dwSize = str2ulong(a); a += 4; + AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry = str2ushort(a); a += 2; +@@ -2605,8 +2647,8 @@ int avi_parse_input_file(avi_t *AVI, int + if (AVI->track[AVI->aptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } + + AVI->track[AVI->aptr].audio_superindex->aIndex = +- calloc(1, AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry * +- AVI->track[AVI->aptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); ++ safecalloc(1, safemulu(sizeof (uint32_t) * AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry, ++ AVI->track[AVI->aptr].audio_superindex->nEntriesInUse)); + + // position of ix## chunks + for (j=0; jtrack[AVI->aptr].audio_superindex->nEntriesInUse; ++j) { +@@ -2639,7 +2681,7 @@ int avi_parse_input_file(avi_t *AVI, int + + a = (char *)(hdrl_data+i); + +- AVI->ttrack[AVI->tptr].audio_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); ++ AVI->ttrack[AVI->tptr].audio_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); + memcpy (AVI->ttrack[AVI->tptr].audio_superindex->fcc, a, 4); a += 4; + AVI->ttrack[AVI->tptr].audio_superindex->dwSize = str2ulong(a); a += 4; + AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry = str2ushort(a); a += 2; +@@ -2654,8 +2696,8 @@ int avi_parse_input_file(avi_t *AVI, int + if (AVI->ttrack[AVI->tptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } + + AVI->ttrack[AVI->tptr].audio_superindex->aIndex = +- calloc(1, AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry * +- AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); ++ safecalloc(1, safemulu(sizeof(uint32_t) * AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry, ++ AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse)); + + // position of ix## chunks + for (j=0; jttrack[AVI->tptr].audio_superindex->nEntriesInUse; ++j) { +@@ -2831,7 +2873,7 @@ int avi_parse_input_file(avi_t *AVI, int + for (j=0; jvideo_superindex->nEntriesInUse; j++) { + + // read from file +- chunk_start = en = calloc(1, AVI->video_superindex->aIndex[j].dwSize+odml_hrdl_len); ++ chunk_start = en = safecalloc(1, AVI->video_superindex->aIndex[j].dwSize+odml_hrdl_len); + + if (xio_lseek(AVI->fdes, AVI->video_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { + /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, */ +@@ -2857,7 +2899,7 @@ int avi_parse_input_file(avi_t *AVI, int + // skip header + en += odml_hrdl_len; + nvi += nrEntries; +- AVI->video_index = (video_index_entry *) realloc (AVI->video_index, nvi * sizeof (video_index_entry)); ++ AVI->video_index = (video_index_entry *) saferealloc (AVI->video_index, nvi * sizeof (video_index_entry)); + if (!AVI->video_index) { + fprintf(stderr, "AVILIB: out of mem (size = %ld)\n", (long)(nvi * sizeof (video_index_entry))); + exit(1); +@@ -2912,7 +2954,7 @@ int avi_parse_input_file(avi_t *AVI, int + for (j=0; jtrack[audtr].audio_superindex->nEntriesInUse; j++) { + + // read from file +- chunk_start = en = calloc(1, AVI->track[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); ++ chunk_start = en = safecalloc(1, AVI->track[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); + + if (xio_lseek(AVI->fdes, AVI->track[audtr].audio_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { + /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, (unsigned long long)AVI->track[audtr].audio_superindex->aIndex[j].qwOffset); */ +@@ -2937,7 +2979,7 @@ int avi_parse_input_file(avi_t *AVI, int + // skip header + en += odml_hrdl_len; + nai[audtr] += nrEntries; +- AVI->track[audtr].audio_index = (audio_index_entry *) realloc (AVI->track[audtr].audio_index, nai[audtr] * sizeof (audio_index_entry)); ++ AVI->track[audtr].audio_index = (audio_index_entry *) saferealloc (AVI->track[audtr].audio_index, nai[audtr] * sizeof (audio_index_entry)); + + while (k < nai[audtr]) { + +@@ -2979,7 +3021,7 @@ int avi_parse_input_file(avi_t *AVI, int + for (j=0; jttrack[audtr].audio_superindex->nEntriesInUse; j++) { + + // read from file +- chunk_start = en = calloc(1, AVI->ttrack[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); ++ chunk_start = en = safecalloc(1, AVI->ttrack[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); + + if (xio_lseek(AVI->fdes, AVI->ttrack[audtr].audio_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { + /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, (unsigned long long)AVI->ttrack[audtr].audio_superindex->aIndex[j].qwOffset); */ +@@ -3001,7 +3043,7 @@ int avi_parse_input_file(avi_t *AVI, int + // skip header + en += odml_hrdl_len; + nti[audtr] += nrEntries; +- AVI->ttrack[audtr].audio_index = (audio_index_entry *) realloc (AVI->ttrack[audtr].audio_index, nti[audtr] * sizeof (audio_index_entry)); ++ AVI->ttrack[audtr].audio_index = (audio_index_entry *) saferealloc (AVI->ttrack[audtr].audio_index, nti[audtr] * sizeof (audio_index_entry)); + + while (k < nti[audtr]) { + +@@ -3050,13 +3092,13 @@ multiple_riff: + nai[0] = AVI->track[0].audio_chunks = AVI->total_frames; + for(j=1; janum; ++j) AVI->track[j].audio_chunks = 0; + +- AVI->video_index = (video_index_entry *) calloc(1, nvi*sizeof(video_index_entry)); ++ AVI->video_index = (video_index_entry *) safecalloc(1, nvi*sizeof(video_index_entry)); + + if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + + for(j=0; janum; ++j) { + if(AVI->track[j].audio_chunks) { +- AVI->track[j].audio_index = (audio_index_entry *) calloc(1, (nai[j]+1)*sizeof(audio_index_entry)); ++ AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, (nai[j]+1)*sizeof(audio_index_entry)); + memset(AVI->track[j].audio_index, 0, (nai[j]+1)*(sizeof(audio_index_entry))); + if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + } +@@ -3079,8 +3121,8 @@ multiple_riff: + + if (aud_chunks - nai[j] -1 <= 0) { + aud_chunks += AVI->total_frames; +- AVI->track[j].audio_index = (audio_index_entry *) +- realloc( AVI->track[j].audio_index, (aud_chunks+1)*sizeof(audio_index_entry)); ++ AVI->track[j].audio_index = (audio_index_entry *) ++ saferealloc( AVI->track[j].audio_index, (aud_chunks+1)*sizeof(audio_index_entry)); + if (!AVI->track[j].audio_index) { + fprintf(stderr, "Internal error in avilib -- no mem\n"); + AVI_errno = AVI_ERR_NO_MEM; +@@ -3167,12 +3209,12 @@ multiple_riff: + + + if(AVI->video_frames==0) ERR_EXIT(AVI_ERR_NO_VIDS); +- AVI->video_index = (video_index_entry *) calloc(1, nvi*sizeof(video_index_entry)); ++ AVI->video_index = (video_index_entry *) safecalloc(1, nvi*sizeof(video_index_entry)); + if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + + for(j=0; janum; ++j) { + if(AVI->track[j].audio_chunks) { +- AVI->track[j].audio_index = (audio_index_entry *) calloc(1, (nai[j]+1)*sizeof(audio_index_entry)); ++ AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, (nai[j]+1)*sizeof(audio_index_entry)); + memset(AVI->track[j].audio_index, 0, (nai[j]+1)*(sizeof(audio_index_entry))); + if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); + } diff -Nru mkvtoolnix-92.0/debian/patches/series mkvtoolnix-92.0/debian/patches/series --- mkvtoolnix-92.0/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ mkvtoolnix-92.0/debian/patches/series 2026-09-14 07:07:05.000000000 +0000 @@ -0,0 +1 @@ +CVE-2026-90783.patch