Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[BUG] Heap buffer overflow in parse_PMT with C0/C1 section length

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,419 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@kun-codes ya está trabajando en esto.

Desde el 22/10/2026.

  • #2420 de @kun-codes — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
78/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c
Área
backend

Línea de trabajo

Empieza en src/lib_ccx/ts_tables.c, en parse_PMT, donde el issue señala el manejo de la longitud de sección C0/C1 y el memmove inseguro. Comprueba cómo se registra la longitud del búfer PSI y luego reproduce el problema con el archivo adjunto pmt_c0.py y el comando de compilación con AddressSanitizer del issue. El trabajo estará terminado cuando se rechacen las secciones más largas que los datos almacenados en el búfer y se evite el desbordamiento indicado; el issue dice que hay disponible un parche mínimo.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

CCExtractor version: 0.96.5 (master d7eb132)

Necessary information

  • Is this a regression (i.e. did it work before)? NO The 0xC1 path dates to 2016 and the 0xC0 memmove to 2020; neither has changed since.
  • What platform did you use? Linux
  • What were the used arguments? pmt_c0.ts --ts

Video links

Not a video. The reproducer generator is attached: pmt_c0.py.

pmt_c0.py

It writes pmt_c0.ts (376 bytes).

Additional information

parse_PMT() handles the SCTE 57 Program Information and Program Name tables (table_id 0xC0/0xC1) by stripping them from the front of the PSI buffer before parsing the PMT that follows. The 12-bit section length is read directly from the input and used without checking it against the number of bytes actually buffered:

unsigned c0length = (buf[1] << 8 | buf[2]) & 0xFFF;
memmove(buf, buf + c0length + 3, len - c0length - 3);

If c0length + 3 is larger than len, the size expression wraps to a value near 2^32 and memmove() reads and writes far outside the 184-byte PSI buffer. This is not limited to deliberately malformed input: a valid C0/C1 section that spans multiple TS packets also hits it, because the memmove() runs before the code checks whether the whole section has been buffered.

Reproduce

  1. Run the attached pmt_c0.py; it creates pmt_c0.ts.

  2. Build with AddressSanitizer. GPAC is required (libgpac-dev on Debian/Ubuntu):

cmake -S src -B build-asan -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug \
  -DCMAKE_C_COMPILER=clang \
  -DCMAKE_CXX_COMPILER=clang++ \
  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1" \
  -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1" \
  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"

cmake --build build-asan -j"$(nproc)"
  1. Run:
ASAN_OPTIONS=detect_leaks=0 ./build-asan/ccextractor pmt_c0.ts --ts

The generated file contains a PAT mapping program 1 to PID 0x100, followed by a PMT packet with table_id = 0xC0 and section_length = 0xFFF.

ASan report (addresses and build IDs vary between builds) 
=================================================================
==163035==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c26841e9b43 at pc 0x559fcb8def54 bp 0x7ffff843f7d0 sp 0x7ffff843ef90
READ of size 4294963381 at 0x7c26841e9b43 thread T0
    #0 0x559fcb8def53 in __asan_memmove (/tmp/ccextractor-parent/build-asan/ccextractor+0x225f53) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)
    #1 0x559fcbba5ffb in parse_PMT /tmp/ccextractor-parent/src/lib_ccx/ts_tables.c
    #2 0x559fcbba2614 in ts_readstream /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:847:9
    #3 0x559fcbba3e74 in ts_get_more_data /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:1098:9
    #4 0x559fcbb71013 in general_loop /tmp/ccextractor-parent/src/lib_ccx/general_loop.c:1443:9
    #5 0x559fcb9c8f13 in start_ccx /tmp/ccextractor-parent/src/ccextractor.c:199:11
    #6 0x7f269b227780 in __libc_start_call_main (/usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:59:16)
    #7 0x7f269b2278b8 in __libc_start_main (/usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:372:3)
    #8 0x559fcb82dfc4 in _start (/tmp/ccextractor-parent/build-asan/ccextractor+0x174fc4) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)

0x7c26841e9b43 is located 3915 bytes after 184-byte region [0x7c26841e8b40,0x7c26841e8bf8)
allocated by thread T0 here:
    #0 0x559fcb8e1394 in malloc (/tmp/ccextractor-parent/build-asan/ccextractor+0x228394) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)
    #1 0x559fcbba8814 in ts_buffer_psi_packet /tmp/ccextractor-parent/src/lib_ccx/ts_tables.c:590:46
    #2 0x559fcbba257e in ts_readstream /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:845:4
    #3 0x559fcbba3e74 in ts_get_more_data /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:1098:9
    #4 0x559fcbb71013 in general_loop /tmp/ccextractor-parent/src/lib_ccx/general_loop.c:1443:9
    #5 0x559fcb9c8f13 in start_ccx /tmp/ccextractor-parent/src/ccextractor.c:199:11
    #6 0x7f269b227780 in __libc_start_call_main (/usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:59:16)
    #7 0x7f269b2278b8 in __libc_start_main (/usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:372:3)
    #8 0x559fcb82dfc4 in _start (/tmp/ccextractor-parent/build-asan/ccextractor+0x174fc4) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/tmp/ccextractor-parent/build-asan/ccextractor+0x225f53) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6) in __asan_memmove
Shadow bytes around the buggy address:
  0x7c26841e9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7c26841e9b00: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa
  0x7c26841e9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==163035==ABORTING

The section should be rejected when c0length + 3 > len, and len should be reduced by c0length + 3 after the move. I have a minimal patch that does both and can open a PR.

Lenguaje dominante
C
Estrellas
912
Forks
598
Merge medio
2 d 17 h
PR fusionados (30 d)
30

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de CCExtractor/ccextractor

Todos los issues de CCExtractor/ccextractor

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.