From 8401e2e366ee5a27410e1f53aaca0aebfd53cb9e Mon Sep 17 00:00:00 2001
From: Steve Lhomme <slhomme@matroska.org>
Date: Fri, 24 Oct 2025 11:18:54 +0200
Subject: [PATCH] KaxBlock: fix leak when reading EBML lace is aborted

---
 src/KaxBlock.cpp | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/KaxBlock.cpp b/src/KaxBlock.cpp
index 3dfda0d7..5ea027b3 100644
--- a/src/KaxBlock.cpp
+++ b/src/KaxBlock.cpp
@@ -626,7 +626,6 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
       if (Result != 5)
         throw SafeReadIOCallback::EndOfStreamX(0);
       binary *cursor = _TempHead;
-      binary *_tmpBuf;
       std::uint8_t BlockHeadSize = 4;
 
       // update internal values
@@ -699,8 +698,10 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
             SizeList[Index] = LastBufferSize;
             break;
           case LACING_EBML:
+          {
             SizeRead = LastBufferSize;
-            cursor = _tmpBuf = new binary[FrameNum*4]; /// \warning assume the mean size will be coded in less than 4 bytes
+            auto _tmpBuf = std::make_unique<binary[]>(FrameNum*4); /// \warning assume the mean size will be coded in less than 4 bytes
+            cursor = _tmpBuf.get();
             Result += input.read(cursor, FrameNum*4);
             FrameSize = ReadCodedSizeValue(cursor, SizeRead, SizeUnknown);
             if (FrameSize > TotalLacedSize)
@@ -720,11 +721,11 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
               LastBufferSize -= FrameSize + SizeRead;
             }
 
-            FirstFrameLocation += cursor - _tmpBuf;
+            FirstFrameLocation += cursor - _tmpBuf.get();
 
             SizeList[Index] = LastBufferSize;
-            delete [] _tmpBuf;
             break;
+          }
           case LACING_FIXED:
             for (Index=0; Index<=FrameNum; Index++) {
               // get the size of the frame