MP4 & PS demuxer panics due to out-of-bounds/ underflow #899

New Issue

claunia · 2026-01-29T16:56:30Z

claunia commented

2026-01-29 16:56:30 +00:00

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 7, 2026).

Description

The demuxer’s stream detection logic can panic when processing certain malformed or very small media files.

PS probing underflow:
- When the input buffer is very small (<3 bytes), the subtraction ctx.startbytes_avail - 3 underflows.
- Causes undefined behavior / crash.
MP4 box validation out-of-bounds:
- The check for "moov" box assumes the buffer has at least 15 bytes beyond the position.
- Small/invalid MP4 inputs can cause buffer[position + 12..14] to panic.

This can crash CCExtractor during normal demuxing.

Steps to Reproduce

# Trigger PS underflow
echo -n "00" > tiny.ps
./ccextractor tiny.ps

# Trigger MP4 out-of-bounds
echo -n "" > empty.mp4
./ccextractor empty.mp4

Expected Behavior

The demuxer should not panic on small or malformed files.
Instead, it should gracefully handle these inputs or return a clear error.

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 7, 2026). ### Description The demuxer’s stream detection logic can panic when processing certain malformed or very small media files. 1. **PS probing underflow:** - When the input buffer is very small (<3 bytes), the subtraction `ctx.startbytes_avail - 3` underflows. - Causes undefined behavior / crash. 2. **MP4 box validation out-of-bounds:** - The check for "moov" box assumes the buffer has at least 15 bytes beyond the position. - Small/invalid MP4 inputs can cause `buffer[position + 12..14]` to panic. This can crash CCExtractor during normal demuxing. --- ### Steps to Reproduce ```bash # Trigger PS underflow echo -n "00" > tiny.ps ./ccextractor tiny.ps # Trigger MP4 out-of-bounds echo -n "" > empty.mp4 ./ccextractor empty.mp4 ``` ### Expected Behavior - The demuxer should not panic on small or malformed files. - Instead, it should gracefully handle these inputs or return a clear error.

claunia closed this issue

2026-01-29 16:56:30 +00:00

claunia commented

2026-01-29 16:56:31 +00:00

@cfsmp3 commented on GitHub (Jan 8, 2026):

Please don't open a ticket for these things - PRs are OK, but issues are for users to report problems. If a developer sees a problem he/she just sends a PR.

@cfsmp3 commented on GitHub (Jan 8, 2026): Please don't open a ticket for these things - PRs are OK, but issues are for users to report problems. If a developer sees a problem he/she just sends a PR.

claunia commented

2026-01-29 16:56:32 +00:00

@THE-Amrit-mahto-05 commented on GitHub (Jan 8, 2026):

@cfsmp3
Got it, thanks for clarifying 👍
I’ll submit fixes directly as PRs and avoid opening issues for developer identified problems.

@THE-Amrit-mahto-05 commented on GitHub (Jan 8, 2026): @cfsmp3 Got it, thanks for clarifying 👍 I’ll submit fixes directly as PRs and avoid opening issues for developer identified problems.

claunia referenced this issue

2026-01-29 17:18:16 +00:00

[PR #899] [MERGED] [IMPROVEMENT] Minor changes - Add default fonts in the --help #1737

claunia referenced this issue

2026-01-29 17:18:19 +00:00

[PR #914] [CLOSED] [IMPROVEMENT] Adds linter and .editorconfig #1749

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#899