Missing master backport of an EBML element-size guard in libebml

While fuzzing the Matroska/EBML parser stack, a malformed-input path in EbmlMaster element reading could reach a state where the remaining size to read (MaxSizeToRead) went negative when an upper element claimed to end after its parent — a file with missing data in the middle. A guard for exactly this situation already existed on libebml’s v1.x branch but had never been forward-ported to master, the branch most consumers build from.

The maintainer (Steve Lhomme) backported the guard to master as commit 372b681c3, crediting the report. This is a robustness/hardening fix — an informational-severity “missing backport” rather than a novel vulnerability, and no CVE was requested. The writeup covers the coordinated-disclosure story and the missing-backport bug class in more detail.