[PR #1805] [MERGED] fix(encoders): replace sprintf/strcpy with bounds-checked versions #2545

New Issue

claunia · 2026-01-29T17:22:43Z

claunia commented

2026-01-29 17:22:43 +00:00

📋 Pull Request Information

Original PR: https://github.com/CCExtractor/ccextractor/pull/1805
Author: @cfsmp3
Created: 12/13/2025
Status: ✅ Merged
Merged: 12/13/2025
Merged by: @cfsmp3

Base: master ← Head: fix/phase3-buffer-safety-sami-srt-mp4-webvtt

📝 Commits (1)

a43cb99 fix(encoders): replace sprintf/strcpy with bounds-checked versions

📊 Changes

4 files changed (+61 additions, -48 deletions)

View changed files

📝 src/lib_ccx/ccx_encoders_sami.c (+17 -17)
📝 src/lib_ccx/ccx_encoders_srt.c (+9 -9)
📝 src/lib_ccx/ccx_encoders_webvtt.c (+27 -13)
📝 src/lib_ccx/mp4.c (+8 -9)

📄 Description

Summary

This PR continues the Phase 3 buffer safety work from the bug analysis plan, replacing unsafe string functions with bounds-checked alternatives:

ccx_encoders_sami.c: 10 sprintf → snprintf conversions
ccx_encoders_srt.c: 6 sprintf → snprintf conversions
mp4.c: 6 fixes including:
- sprintf/strcpy/strcat → snprintf
- Critical fix: Buffer overflow in format_duration() where 20-byte buffer was too small for long duration strings (e.g., "365 Days, 23:59:59.999" = 22+ chars)
- Added size parameter to format_duration() function
ccx_encoders_webvtt.c: 6 sprintf → snprintf conversions, plus:
- Fixed malloc size bug (+4 instead of +5 for null terminator)
- Added OOM checks for css_file_name and outline_css_file
- Fixed memory leaks (allocated strings were not freed)

Test plan

Build completes successfully
Test with SAMI output format
Test with SRT output format
Test with WebVTT output format (including CSS generation)
Test with MP4 files containing chapters

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/CCExtractor/ccextractor/pull/1805 **Author:** [@cfsmp3](https://github.com/cfsmp3) **Created:** 12/13/2025 **Status:** ✅ Merged **Merged:** 12/13/2025 **Merged by:** [@cfsmp3](https://github.com/cfsmp3) **Base:** `master` ← **Head:** `fix/phase3-buffer-safety-sami-srt-mp4-webvtt` --- ### 📝 Commits (1) - [`a43cb99`](https://github.com/CCExtractor/ccextractor/commit/a43cb9979dcf29b2465b128457e3f15a824dddc3) fix(encoders): replace sprintf/strcpy with bounds-checked versions ### 📊 Changes **4 files changed** (+61 additions, -48 deletions) <details> <summary>View changed files</summary> 📝 `src/lib_ccx/ccx_encoders_sami.c` (+17 -17) 📝 `src/lib_ccx/ccx_encoders_srt.c` (+9 -9) 📝 `src/lib_ccx/ccx_encoders_webvtt.c` (+27 -13) 📝 `src/lib_ccx/mp4.c` (+8 -9) </details> ### 📄 Description ## Summary This PR continues the Phase 3 buffer safety work from the bug analysis plan, replacing unsafe string functions with bounds-checked alternatives: - **ccx_encoders_sami.c**: 10 `sprintf` → `snprintf` conversions - **ccx_encoders_srt.c**: 6 `sprintf` → `snprintf` conversions - **mp4.c**: 6 fixes including: - `sprintf`/`strcpy`/`strcat` → `snprintf` - **Critical fix**: Buffer overflow in `format_duration()` where 20-byte buffer was too small for long duration strings (e.g., "365 Days, 23:59:59.999" = 22+ chars) - Added size parameter to `format_duration()` function - **ccx_encoders_webvtt.c**: 6 `sprintf` → `snprintf` conversions, plus: - Fixed malloc size bug (`+4` instead of `+5` for null terminator) - Added OOM checks for `css_file_name` and `outline_css_file` - Fixed memory leaks (allocated strings were not freed) ## Test plan - [x] Build completes successfully - [ ] Test with SAMI output format - [ ] Test with SRT output format - [ ] Test with WebVTT output format (including CSS generation) - [ ] Test with MP4 files containing chapters 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

claunia added the pull-request label 2026-01-29 17:22:43 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#2545