From 10d9230836ae39f4dda14109f9284e23b1c29f28 Mon Sep 17 00:00:00 2001
From: Dhanush <dhanush.n175@gmail.com>
Date: Sun, 19 Apr 2026 00:28:10 +0530
Subject: [PATCH] Fix/cea 708 c1 bounds check (#2258)

* fix: move C0 bounds check before match, improve C1 warn message

- C0 handler: bounds check was after the match, meaning process_p16(&block[1..])
  could panic with an index out of bounds before the guard ran. Moved the check
  before the match to prevent this.
- C1 handler: improved the warn message to include command code, name, and
  lengths for easier debugging.

Fixes #1407

* docs: update CHANGES.TXT for #1407 fix

* style: cargo fmt

---------

Co-authored-by: Dhanush Varma <your@email.com>
---
 docs/CHANGES.TXT                        |  1 +
 src/rust/src/decoder/service_decoder.rs | 25 ++++++++++++++++---------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/docs/CHANGES.TXT b/docs/CHANGES.TXT
index e43582a5..50b8ce72 100644
--- a/docs/CHANGES.TXT
+++ b/docs/CHANGES.TXT
@@ -1,5 +1,6 @@
 0.96.7 (unreleased)
 -------------------
+- Fix: Move C0 bounds check before match in CEA-708 Rust decoder to prevent process_p16 index-out-of-bounds panic on truncated ATSC1.0 TS blocks; improve C1 warn message with command code and lengths (#1407)
 - New: Allow output \0 terminated frames via --null-terminated
 - New: Added ASS/SSA \pos-based positioning for CEA-608 captions when layout is simple (1–2 rows) (#1726)
 - New: Auto-extract multi-language DVB subtitles into per-language files.(#2243)
diff --git a/src/rust/src/decoder/service_decoder.rs b/src/rust/src/decoder/service_decoder.rs
index f57ab2c2..6b9019b6 100644
--- a/src/rust/src/decoder/service_decoder.rs
+++ b/src/rust/src/decoder/service_decoder.rs
@@ -77,6 +77,15 @@ impl dtvcc_service_decoder {
         let code = block[0];
         let C0Command { command, length } = C0Command::new(code);
         debug!("C0: [{:?}] ({})", command, block.len());
+        if length as usize > block.len() {
+            warn!(
+                "dtvcc_handle_C0: command {:#04X} needs {} bytes but block only has {}; skipping",
+                code,
+                length,
+                block.len()
+            );
+            return -1;
+        }
         match command {
             // NUL command does nothing
             C0CodeSet::NUL => {}
@@ -90,14 +99,6 @@ impl dtvcc_service_decoder {
             C0CodeSet::P16 => self.process_p16(&block[1..]),
             C0CodeSet::RESERVED => {}
         }
-        if length as usize > block.len() {
-            warn!(
-                "dtvcc_handle_C0: command is {} bytes long but we only have {}",
-                length,
-                block.len()
-            );
-            return -1;
-        }
         length as i32
     }
 
@@ -286,7 +287,13 @@ impl dtvcc_service_decoder {
         } = C1Command::new(code);
 
         if length as usize > block.len() {
-            warn!("Warning: Not enough bytes for command.");
+            warn!(
+                "dtvcc_handle_C1: command {:#04X} ({}) needs {} bytes but block only has {}; skipping",
+                code,
+                name,
+                length,
+                block.len()
+            );
             return -1;
         }