[PR #1803] [MERGED] fix(xds_decoder): prevent buffer overruns and fix sprintf logic bug #2542

New Issue

claunia · 2026-01-29T17:22:42Z

claunia commented

2026-01-29 17:22:42 +00:00

📋 Pull Request Information

Original PR: https://github.com/CCExtractor/ccextractor/pull/1803
Author: @cfsmp3
Created: 12/13/2025
Status: ✅ Merged
Merged: 12/13/2025
Merged by: @cfsmp3

Base: master ← Head: fix/xds-decoder-buffer-overruns

📝 Commits (1)

79acc02 fix(xds_decoder): prevent buffer overruns and fix sprintf logic bug

📊 Changes

1 file changed (+40 additions, -16 deletions)

View changed files

📝 src/lib_ccx/ccx_decoders_xds.c (+40 -16)

📄 Description

Summary

This PR fixes multiple buffer overrun vulnerabilities and a logic bug in the XDS (Extended Data Services) decoder in src/lib_ccx/ccx_decoders_xds.c.

Issues Found and Fixed

1. Unsafe `sprintf` Calls (10 instances)

All sprintf calls into fixed-size static buffers were replaced with snprintf using sizeof():

Function	Buffer	Size	Fix
`xds_do_copy_generation_management_system`	`copy_permited`	256	`snprintf(..., sizeof(copy_permited), ...)`
`xds_do_copy_generation_management_system`	`aps`	256	`snprintf(..., sizeof(aps), ...)`
`xds_do_copy_generation_management_system`	`rcd`	256	`snprintf(..., sizeof(rcd), ...)`
`xds_do_content_advisory`	`age`	256	`snprintf(..., sizeof(age), ...)`
`xds_do_content_advisory`	`rating`	256	`snprintf(..., sizeof(rating), ...)` (3 locations)
`xds_do_content_advisory`	`content`	256	`snprintf(..., sizeof(content), ...)`

2. Unsafe `strcpy`/`strcat` Chain in `xds_do_content_advisory`

Before:

content[0] = 0;
if (FV) strcpy(content, "[Violence] ");
if (S) strcat(content, "[Sexual Situations] ");
if (La3) strcat(content, "[Adult Language] ");
if (Da2) strcat(content, "[Sexually Suggestive Dialog] ");

After:

content[0] = 0;
size_t content_len = 0;
if (FV) {
    snprintf(content, sizeof(content), "[Violence] ");
    content_len = strlen(content);
}
if (S) {
    snprintf(content + content_len, sizeof(content) - content_len, "[Sexual Situations] ");
    content_len = strlen(content);
}
// ... etc

3. Unsafe `strcpy` into Fixed-Size Context Buffers

Two strcpy calls into 33-byte context structure fields were replaced with bounded copies:

Location	Buffer Size	Fix
`xds_do_current_and_future`	`xds_program_description[line_num][33]`	`strncpy(..., 32)` + null terminator
`xds_do_channel`	`current_xds_network_name[33]`	`strncpy(..., 32)` + null terminator

4. Logic Bug in `xds_do_private_data` (CRITICAL)

Before (BUG):

str = malloc((ctx->cur_xds_payload_length * 3) + 1);
for (i = 2; i < ctx->cur_xds_payload_length - 1; i++)
    sprintf(str, "%02X ", ctx->cur_xds_payload[i]);  // OVERWRITES each iteration!

This was a logic bug where each iteration overwrote the buffer instead of appending. The output would only contain the last byte instead of all bytes.

After (FIXED):

size_t str_size = (ctx->cur_xds_payload_length * 3) + 1;
str = malloc(str_size);
str[0] = '\0';
size_t offset = 0;
for (i = 2; i < ctx->cur_xds_payload_length - 1; i++) {
    int written = snprintf(str + offset, str_size - offset, "%02X ", ctx->cur_xds_payload[i]);
    if (written > 0)
        offset += written;
}

Code Changes Summary

Metric	Before	After
`sprintf()` calls	10	0
`strcpy()` calls	4	0
`strcat()` calls	4	0
`snprintf()` calls	0	14
`strncpy()` calls	0	2
Logic bugs	1	0

Security Impact

These fixes prevent:

Stack buffer overflow via static 256-byte buffers with unbounded sprintf
Heap buffer overflow via 33-byte context structure fields with strcpy
Data corruption via logic bug that discarded all but the last hex byte

XDS data comes from closed caption streams in broadcast video, which could potentially be manipulated in adversarial scenarios.

Test Plan

Code compiles without warnings from ccx_decoders_xds.c
Build completes successfully
Test with sample files containing XDS data
Verify XDS output is correct (especially private data hex dump)

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/CCExtractor/ccextractor/pull/1803 **Author:** [@cfsmp3](https://github.com/cfsmp3) **Created:** 12/13/2025 **Status:** ✅ Merged **Merged:** 12/13/2025 **Merged by:** [@cfsmp3](https://github.com/cfsmp3) **Base:** `master` ← **Head:** `fix/xds-decoder-buffer-overruns` --- ### 📝 Commits (1) - [`79acc02`](https://github.com/CCExtractor/ccextractor/commit/79acc0256b62a516fd07e0ad86998b4ea9d05db6) fix(xds_decoder): prevent buffer overruns and fix sprintf logic bug ### 📊 Changes **1 file changed** (+40 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `src/lib_ccx/ccx_decoders_xds.c` (+40 -16) </details> ### 📄 Description ## Summary This PR fixes multiple buffer overrun vulnerabilities and a logic bug in the XDS (Extended Data Services) decoder in `src/lib_ccx/ccx_decoders_xds.c`. ## Issues Found and Fixed ### 1. Unsafe `sprintf` Calls (10 instances) All `sprintf` calls into fixed-size static buffers were replaced with `snprintf` using `sizeof()`: | Function | Buffer | Size | Fix | |----------|--------|------|-----| | `xds_do_copy_generation_management_system` | `copy_permited` | 256 | `snprintf(..., sizeof(copy_permited), ...)` | | `xds_do_copy_generation_management_system` | `aps` | 256 | `snprintf(..., sizeof(aps), ...)` | | `xds_do_copy_generation_management_system` | `rcd` | 256 | `snprintf(..., sizeof(rcd), ...)` | | `xds_do_content_advisory` | `age` | 256 | `snprintf(..., sizeof(age), ...)` | | `xds_do_content_advisory` | `rating` | 256 | `snprintf(..., sizeof(rating), ...)` (3 locations) | | `xds_do_content_advisory` | `content` | 256 | `snprintf(..., sizeof(content), ...)` | ### 2. Unsafe `strcpy`/`strcat` Chain in `xds_do_content_advisory` **Before:** ```c content[0] = 0; if (FV) strcpy(content, "[Violence] "); if (S) strcat(content, "[Sexual Situations] "); if (La3) strcat(content, "[Adult Language] "); if (Da2) strcat(content, "[Sexually Suggestive Dialog] "); ``` **After:** ```c content[0] = 0; size_t content_len = 0; if (FV) { snprintf(content, sizeof(content), "[Violence] "); content_len = strlen(content); } if (S) { snprintf(content + content_len, sizeof(content) - content_len, "[Sexual Situations] "); content_len = strlen(content); } // ... etc ``` ### 3. Unsafe `strcpy` into Fixed-Size Context Buffers Two `strcpy` calls into 33-byte context structure fields were replaced with bounded copies: | Location | Buffer Size | Fix | |----------|-------------|-----| | `xds_do_current_and_future` | `xds_program_description[line_num][33]` | `strncpy(..., 32)` + null terminator | | `xds_do_channel` | `current_xds_network_name[33]` | `strncpy(..., 32)` + null terminator | ### 4. Logic Bug in `xds_do_private_data` (CRITICAL) **Before (BUG):** ```c str = malloc((ctx->cur_xds_payload_length * 3) + 1); for (i = 2; i < ctx->cur_xds_payload_length - 1; i++) sprintf(str, "%02X ", ctx->cur_xds_payload[i]); // OVERWRITES each iteration! ``` This was a logic bug where each iteration overwrote the buffer instead of appending. The output would only contain the last byte instead of all bytes. **After (FIXED):** ```c size_t str_size = (ctx->cur_xds_payload_length * 3) + 1; str = malloc(str_size); str[0] = '\0'; size_t offset = 0; for (i = 2; i < ctx->cur_xds_payload_length - 1; i++) { int written = snprintf(str + offset, str_size - offset, "%02X ", ctx->cur_xds_payload[i]); if (written > 0) offset += written; } ``` ## Code Changes Summary | Metric | Before | After | |--------|--------|-------| | `sprintf()` calls | 10 | 0 | | `strcpy()` calls | 4 | 0 | | `strcat()` calls | 4 | 0 | | `snprintf()` calls | 0 | 14 | | `strncpy()` calls | 0 | 2 | | Logic bugs | 1 | 0 | ## Security Impact These fixes prevent: - **Stack buffer overflow** via static 256-byte buffers with unbounded sprintf - **Heap buffer overflow** via 33-byte context structure fields with strcpy - **Data corruption** via logic bug that discarded all but the last hex byte XDS data comes from closed caption streams in broadcast video, which could potentially be manipulated in adversarial scenarios. ## Test Plan - [x] Code compiles without warnings from ccx_decoders_xds.c - [x] Build completes successfully - [ ] Test with sample files containing XDS data - [ ] Verify XDS output is correct (especially private data hex dump) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

claunia added the pull-request label 2026-01-29 17:22:42 +00:00

claunia closed this issue

2026-01-29 17:22:42 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#2542

[PR #1803] [MERGED] fix(xds_decoder): prevent buffer overruns and fix sprintf logic bug #2542