{"record":{"id":"84120d9e07e8772e","repo":"SubtitleEdit/subtitleedit","slug":"mxf-klv-packet-lenght-bytes-8","errorCode":null,"errorMessage":"MXF KLV packet - lenght bytes > 8","messagePattern":"MXF KLV packet - lenght bytes > 8","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/libse/ContainerFormats/MaterialExchangeFormat/KlvPacket.cs","lineNumber":64,"sourceCode":"            }\n        }\n\n        /// <summary>\n        /// Read length - never be more than 9 bytes in size (which means max 8 bytes of payload length)\n        /// There are four kinds of encoding for the Length field: 1-byte, 2-byte, 4-byte\n        /// </summary>\n        /// <param name=\"stream\"></param>\n        /// <param name=\"bytesInLength\"></param>\n        /// <returns></returns>\n        private long GetBasicEncodingRuleLength(Stream stream, out int bytesInLength)\n        {\n            int first = stream.ReadByte();\n            if (first > 127) // first bit set\n            {\n                bytesInLength = first & 0b01111111;\n                if (bytesInLength > 8)\n                {\n                    throw new Exception(\"MXF KLV packet - lenght bytes > 8\");\n                }\n                DataSize = 0;\n                for (int i = 0; i < bytesInLength; i++)\n                {\n                    DataSize = DataSize * 256 + stream.ReadByte();\n                }\n                bytesInLength++;\n                return DataSize;\n            }\n            bytesInLength = 1;\n            return first;\n        }\n\n        public KeyIdentifier IdentifierType\n        {\n            get\n            {\n                if (IsKey(PartitionPack))","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/SubtitleEdit/subtitleedit/blob/17a9f0748781032255db3526b7215d2fb891e3af/src/libse/ContainerFormats/MaterialExchangeFormat/KlvPacket.cs#L46-L82","documentation":"GetBasicEncodingRuleLength decodes the BER length prefix of a KLV triplet. The first byte's high bit signals a long-form length where the low 7 bits give the number of follow-on length bytes. The SMPTE/MXF spec caps that count at 8; a larger value means a malformed or non-BER stream and the parser refuses to allocate an attacker-controlled number of ReadByte calls.","triggerScenarios":"First byte >= 0x89 (high bit set, low 7 bits > 8) at a position assumed to be a length field; misaligned stream where the parser treats key data as a length byte; maliciously crafted MXF designed to exhaust or overflow.","commonSituations":"Parsing a non-MXF stream as MXF; corrupt header; byte-order confusion after a partial seek; fuzz test input.","solutions":["Verify the 16-byte key matches a known SMPTE Universal Label before attempting length decode.","Reject the file at a higher level when this InvalidDataException surfaces, rather than retrying.","Ensure the stream position is at a true KLV triplet boundary (do not skip arbitrary bytes).","Re-acquire the MXF from a trusted source."],"exampleFix":"// before\nbytesInLength = first & 0b01111111;\nif (bytesInLength > 8) throw new Exception(\"MXF KLV packet - lenght bytes > 8\");\n\n// after\nbytesInLength = first & 0b01111111;\nif (bytesInLength > 8) throw new InvalidDataException($\"BER length-of-length {bytesInLength} exceeds 8 at offset {stream.Position - 1}\");","handlingStrategy":"validation","validationCode":"if (!stream.CanRead) throw new ArgumentException(\"stream must be readable\");\n// verify preceding 16-byte key matched a known SMPTE UL before length decode","typeGuard":null,"tryCatchPattern":"try { var pkt = new KlvPacket(stream); }\ncatch (Exception ex) when (ex.Message.Contains(\"lenght bytes\")) { /* not MXF / corrupt */ }","preventionTips":["Confirm the 16-byte key is a known SMPTE Universal Label before trusting the length field.","Do not parse arbitrary streams as MXF."],"tags":["mxf","klv","ber","validation","container-format"],"backgroundTag":null,"analyzedSha":"17a9f0748781032255db3526b7215d2fb891e3af","analyzedAt":"2026-08-13T18:11:43.374Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}