MP4 & PS demuxer panics due to out-of-bounds/ underflow #896

New Issue

claunia · 2026-01-29T16:56:27Z

claunia commented

2026-01-29 16:56:27 +00:00

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 7, 2026).

Description

The demuxer’s stream detection logic can panic when processing certain malformed or very small media files.

PS probing underflow:
- When the input buffer is very small (<3 bytes), the subtraction ctx.startbytes_avail - 3 underflows.
- Causes undefined behavior / crash.
MP4 box validation out-of-bounds:
- The check for "moov" box assumes the buffer has at least 15 bytes beyond the position.
- Small/invalid MP4 inputs can cause buffer[position + 12..14] to panic.

This can crash CCExtractor during normal demuxing.

Steps to Reproduce

# Trigger PS underflow
echo -n "00" > tiny.ps
./ccextractor tiny.ps

# Trigger MP4 out-of-bounds
echo -n "" > empty.mp4
./ccextractor empty.mp4

Expected Behavior

The demuxer should not panic on small or malformed files.
Instead, it should gracefully handle these inputs or return a clear error.

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 7, 2026). ### Description The demuxer’s stream detection logic can panic when processing certain malformed or very small media files. 1. **PS probing underflow:** - When the input buffer is very small (<3 bytes), the subtraction `ctx.startbytes_avail - 3` underflows. - Causes undefined behavior / crash. 2. **MP4 box validation out-of-bounds:** - The check for "moov" box assumes the buffer has at least 15 bytes beyond the position. - Small/invalid MP4 inputs can cause `buffer[position + 12..14]` to panic. This can crash CCExtractor during normal demuxing. --- ### Steps to Reproduce ```bash # Trigger PS underflow echo -n "00" > tiny.ps ./ccextractor tiny.ps # Trigger MP4 out-of-bounds echo -n "" > empty.mp4 ./ccextractor empty.mp4 ``` ### Expected Behavior - The demuxer should not panic on small or malformed files. - Instead, it should gracefully handle these inputs or return a clear error.

claunia referenced this issue

2026-01-29 17:18:15 +00:00

[PR #897] [MERGED] [IMPROVEMENT] Fix some warnings (#896 ) #1736

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#896