SubtitleEdit/subtitleedit · error · Exception

MXF KLV packet - lenght bytes > 8

Error message

MXF KLV packet - lenght bytes > 8

What it means

GetBasicEncodingRuleLength decodes the BER length prefix of a KLV triplet. The first byte's high bit signals a long-form length where the low 7 bits give the number of follow-on length bytes. The SMPTE/MXF spec caps that count at 8; a larger value means a malformed or non-BER stream and the parser refuses to allocate an attacker-controlled number of ReadByte calls.

Source

Thrown at src/libse/ContainerFormats/MaterialExchangeFormat/KlvPacket.cs:64

            }
        }

        /// <summary>
        /// Read length - never be more than 9 bytes in size (which means max 8 bytes of payload length)
        /// There are four kinds of encoding for the Length field: 1-byte, 2-byte, 4-byte
        /// </summary>
        /// <param name="stream"></param>
        /// <param name="bytesInLength"></param>
        /// <returns></returns>
        private long GetBasicEncodingRuleLength(Stream stream, out int bytesInLength)
        {
            int first = stream.ReadByte();
            if (first > 127) // first bit set
            {
                bytesInLength = first & 0b01111111;
                if (bytesInLength > 8)
                {
                    throw new Exception("MXF KLV packet - lenght bytes > 8");
                }
                DataSize = 0;
                for (int i = 0; i < bytesInLength; i++)
                {
                    DataSize = DataSize * 256 + stream.ReadByte();
                }
                bytesInLength++;
                return DataSize;
            }
            bytesInLength = 1;
            return first;
        }

        public KeyIdentifier IdentifierType
        {
            get
            {
                if (IsKey(PartitionPack))

View on GitHub (pinned to 17a9f07487)

Solutions

1. Verify the 16-byte key matches a known SMPTE Universal Label before attempting length decode.
2. Reject the file at a higher level when this InvalidDataException surfaces, rather than retrying.
3. Ensure the stream position is at a true KLV triplet boundary (do not skip arbitrary bytes).
4. Re-acquire the MXF from a trusted source.

Example fix

// before
bytesInLength = first & 0b01111111;
if (bytesInLength > 8) throw new Exception("MXF KLV packet - lenght bytes > 8");

// after
bytesInLength = first & 0b01111111;
if (bytesInLength > 8) throw new InvalidDataException($"BER length-of-length {bytesInLength} exceeds 8 at offset {stream.Position - 1}");

if (!stream.CanRead) throw new ArgumentException("stream must be readable");
// verify preceding 16-byte key matched a known SMPTE UL before length decode

try { var pkt = new KlvPacket(stream); }
catch (Exception ex) when (ex.Message.Contains("lenght bytes")) { /* not MXF / corrupt */ }

When it happens

Trigger: First byte >= 0x89 (high bit set, low 7 bits > 8) at a position assumed to be a length field; misaligned stream where the parser treats key data as a length byte; maliciously crafted MXF designed to exhaust or overflow.

Common situations: Parsing a non-MXF stream as MXF; corrupt header; byte-order confusion after a partial seek; fuzz test input.

Related errors

• MXF KLV packet - stream does not have 16 bytes available for
• Too many bytes for CCData!
• Color '{colorName}' not found in SKColors.
• End of file reached before expected
• Problem reading AVI header.

AI-assisted analysis of SubtitleEdit/subtitleedit@17a9f07487 (2026-08-13). Data as JSON: /api/errors/84120d9e07e8772e. Report an issue: GitHub.