Critical TS/ES Decoder Vulnerabilities: Integer Overflow, Stack Overflow, Heap Over-read #883

New Issue

claunia · 2026-01-29T16:56:06Z

claunia commented

2026-01-29 16:56:06 +00:00

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 2, 2026).

I have discovered three critical and previously unreported vulnerabilities in CCExtractor's Transport Stream (TS) and Elementary Stream (ES) decoders:

Integer Overflow in TS PSI buffer (ts_tables.c)
- Cause: 32-bit wrap-around during PSI buffer reallocation (ts_buffer_psi_packet).
- Impact: Heap corruption or memory mismanagement.
- Trigger: Large TS PSI packets exceeding 1MB combined buffer size.
Stack Overflow in SCTE 20 parsing (es_userdata.c)
- Cause: Maximum caption count (31) can lead to 2-byte overflow in cc_data array.
- Impact: Stack memory corruption.
- Trigger: Malformed SCTE 20 user_data packet with max captions.
Heap Buffer Over-read in GXF VBI parsing (es_userdata.c)
- Cause: decode_vbi reads 720 bytes unconditionally regardless of udatalen.
- Impact: Heap buffer over-read, potential information leak or crash.
- Trigger: Malformed or truncated GXF VBI packet.

Affected functions/files:

ts_tables.c → ts_buffer_psi_packet
es_userdata.c → SCTE 20 handling / GXF VBI handling

Proposed Fixes (ready to implement in separate branch):

Bounds checking for PSI buffer reallocation to prevent integer overflow.
Extend cc_data array and add termination for SCTE 20 stack safety.
Verify udatalen >= 720 before calling decode_vbi to prevent over-read.

Impact if unpatched:

Heap corruption, stack overflow, and buffer over-read in core decoders.
Potential crashes or undefined behavior for malformed streams.

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 2, 2026). I have discovered three critical and previously unreported vulnerabilities in CCExtractor's Transport Stream (TS) and Elementary Stream (ES) decoders: 1. **Integer Overflow in TS PSI buffer (`ts_tables.c`)** - Cause: 32-bit wrap-around during PSI buffer reallocation (`ts_buffer_psi_packet`). - Impact: Heap corruption or memory mismanagement. - Trigger: Large TS PSI packets exceeding 1MB combined buffer size. 2. **Stack Overflow in SCTE 20 parsing (`es_userdata.c`)** - Cause: Maximum caption count (31) can lead to 2-byte overflow in `cc_data` array. - Impact: Stack memory corruption. - Trigger: Malformed SCTE 20 user_data packet with max captions. 3. **Heap Buffer Over-read in GXF VBI parsing (`es_userdata.c`)** - Cause: `decode_vbi` reads 720 bytes unconditionally regardless of `udatalen`. - Impact: Heap buffer over-read, potential information leak or crash. - Trigger: Malformed or truncated GXF VBI packet. **Affected functions/files:** - `ts_tables.c` → `ts_buffer_psi_packet` - `es_userdata.c` → SCTE 20 handling / GXF VBI handling **Proposed Fixes (ready to implement in separate branch):** - Bounds checking for PSI buffer reallocation to prevent integer overflow. - Extend `cc_data` array and add termination for SCTE 20 stack safety. - Verify `udatalen >= 720` before calling `decode_vbi` to prevent over-read. **Impact if unpatched:** - Heap corruption, stack overflow, and buffer over-read in core decoders. - Potential crashes or undefined behavior for malformed streams.

claunia closed this issue

2026-01-29 16:56:06 +00:00

claunia commented

2026-01-29 16:56:08 +00:00

@cfsmp3 commented on GitHub (Jan 2, 2026):

This is not critical unless you provide an example file that shows the problem (fine if you create it yourself, but it must hit the code path that shows the problem).

I'm going to close all these small issues with theoretical problems - they add a lot of overhead to my workload.

@cfsmp3 commented on GitHub (Jan 2, 2026): This is not critical unless you provide an example file that shows the problem (fine if you create it yourself, but it must hit the code path that shows the problem). I'm going to close all these small issues with theoretical problems - they add a lot of overhead to my workload.

claunia referenced this issue

2026-01-29 17:18:12 +00:00

[PR #883] [CLOSED] Revert 4 revert 3 revert 2 revert 1 kvdd patch 1 #1725

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#883