Stack Buffer Overflow in ISDB-CC decoder parse_csi (ccx_decoders_isdb.c) #874

New Issue

claunia · 2026-01-29T16:55:53Z

claunia commented

2026-01-29 16:55:53 +00:00

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 1, 2026).

Description

A stack buffer overflow exists in the ISDB-CC decoder.

Component: ISDB-CC decoder
File: src/lib_ccx/ccx_decoders_isdb.c
Function: parse_csi

Problem

The function parse_csi uses a small stack buffer uint8_t arg[10] to store CSI command arguments.
The original code had a dangerous off-by-one error:

if (i >= (sizeof(arg)) + 1)

This allows writing 11 bytes into a 10-byte buffer, causing a stack buffer overflow.
An attacker or malformed subtitle could crash the program or corrupt memory.

Proposed Fix

Corrected the loop boundary:

if (i >= sizeof(arg) - 1)

Added a final bounds check:

if (i < sizeof(arg))
    arg[i] = *buf++;

Improved logging for malformed CSI commands.

Impact

Prevents stack memory corruption
Prevents program crashes
Keeps normal functionality intact

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 1, 2026). ### Description A stack buffer overflow exists in the ISDB-CC decoder. **Component:** ISDB-CC decoder **File:** src/lib_ccx/ccx_decoders_isdb.c **Function:** parse_csi ### Problem The function `parse_csi` uses a small stack buffer `uint8_t arg[10]` to store CSI command arguments. The original code had a dangerous off-by-one error: ```c if (i >= (sizeof(arg)) + 1) ``` This allows writing 11 bytes into a 10-byte buffer, causing a stack buffer overflow. An attacker or malformed subtitle could crash the program or corrupt memory. ### Proposed Fix - Corrected the loop boundary: ```c if (i >= sizeof(arg) - 1) ``` - Added a final bounds check: ```c if (i < sizeof(arg)) arg[i] = *buf++; ``` - Improved logging for malformed CSI commands. ### Impact - Prevents stack memory corruption - Prevents program crashes - Keeps normal functionality intact

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#874