[PR #2057] fix: prevent heap overflow in parse_PAT/parse_PMT and null deref in processmp4 #2868

New Issue

claunia · 2026-01-29T17:24:20Z

claunia commented

2026-01-29 17:24:20 +00:00

Original Pull Request: https://github.com/CCExtractor/ccextractor/pull/2057

State: closed
Merged: Yes

Summary

parse_PAT: Add bounds check for payload_length >= 8 before accessing header fields (fixes #2053)
parse_PMT: Add ES_info_length validation and 2-byte minimum check before reading descriptor_tag and desc_len in PRIVATE_USER_MPEG2 and teletext parsing loops (fixes #2054)
processmp4: Add NULL check for file parameter before passing to mprint (fixes #2055)

These are security fixes for heap-buffer-overflow and null pointer dereference vulnerabilities reported by @oneafter.

Test plan

Build with ASAN enabled and test with the reproducer files from the issues
Verify normal TS and MP4 file processing still works

Fixes #2053, #2054, #2055

🤖 Generated with Claude Code

**Original Pull Request:** https://github.com/CCExtractor/ccextractor/pull/2057 **State:** closed **Merged:** Yes --- ## Summary - **parse_PAT**: Add bounds check for `payload_length >= 8` before accessing header fields (fixes #2053) - **parse_PMT**: Add `ES_info_length` validation and 2-byte minimum check before reading `descriptor_tag` and `desc_len` in `PRIVATE_USER_MPEG2` and teletext parsing loops (fixes #2054) - **processmp4**: Add NULL check for `file` parameter before passing to `mprint` (fixes #2055) These are security fixes for heap-buffer-overflow and null pointer dereference vulnerabilities reported by @oneafter. ## Test plan - [ ] Build with ASAN enabled and test with the reproducer files from the issues - [ ] Verify normal TS and MP4 file processing still works Fixes #2053, #2054, #2055 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claunia added the pull-request label 2026-01-29 17:24:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#2868