Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[BUG] Heap buffer overflow in parse_PMT with C0/C1 section length

Aperta Adatta ai principianti
  • Qualcosa non va?
#2,419 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@kun-codes ci sta già lavorando.

Dal 22/10/2026.

  • #2420 di @kun-codes — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c
Ambito
backend

Direzione di ricerca

Inizia in src/lib_ccx/ts_tables.c, in parse_PMT, dove la issue segnala la gestione della lunghezza della sezione C0/C1 e il memmove non sicuro. Controlla come viene tracciata la lunghezza del buffer PSI, quindi riproduci il problema con il file allegato pmt_c0.py e il comando di compilazione con AddressSanitizer riportato nella issue. Il lavoro è completato quando vengono rifiutate le sezioni più lunghe dei dati nel buffer e si evita l’overflow segnalato; la issue dice che è disponibile una patch minima.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CCExtractor version: 0.96.5 (master d7eb132)

Necessary information

  • Is this a regression (i.e. did it work before)? NO The 0xC1 path dates to 2016 and the 0xC0 memmove to 2020; neither has changed since.
  • What platform did you use? Linux
  • What were the used arguments? pmt_c0.ts --ts

Video links

Not a video. The reproducer generator is attached: pmt_c0.py.

pmt_c0.py

It writes pmt_c0.ts (376 bytes).

Additional information

parse_PMT() handles the SCTE 57 Program Information and Program Name tables (table_id 0xC0/0xC1) by stripping them from the front of the PSI buffer before parsing the PMT that follows. The 12-bit section length is read directly from the input and used without checking it against the number of bytes actually buffered:

unsigned c0length = (buf[1] << 8 | buf[2]) & 0xFFF;
memmove(buf, buf + c0length + 3, len - c0length - 3);

If c0length + 3 is larger than len, the size expression wraps to a value near 2^32 and memmove() reads and writes far outside the 184-byte PSI buffer. This is not limited to deliberately malformed input: a valid C0/C1 section that spans multiple TS packets also hits it, because the memmove() runs before the code checks whether the whole section has been buffered.

Reproduce

  1. Run the attached pmt_c0.py; it creates pmt_c0.ts.

  2. Build with AddressSanitizer. GPAC is required (libgpac-dev on Debian/Ubuntu):

cmake -S src -B build-asan -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug \
  -DCMAKE_C_COMPILER=clang \
  -DCMAKE_CXX_COMPILER=clang++ \
  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1" \
  -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1" \
  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"

cmake --build build-asan -j"$(nproc)"
  1. Run:
ASAN_OPTIONS=detect_leaks=0 ./build-asan/ccextractor pmt_c0.ts --ts

The generated file contains a PAT mapping program 1 to PID 0x100, followed by a PMT packet with table_id = 0xC0 and section_length = 0xFFF.

ASan report (addresses and build IDs vary between builds) 
=================================================================
==163035==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c26841e9b43 at pc 0x559fcb8def54 bp 0x7ffff843f7d0 sp 0x7ffff843ef90
READ of size 4294963381 at 0x7c26841e9b43 thread T0
    #0 0x559fcb8def53 in __asan_memmove (/tmp/ccextractor-parent/build-asan/ccextractor+0x225f53) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)
    #1 0x559fcbba5ffb in parse_PMT /tmp/ccextractor-parent/src/lib_ccx/ts_tables.c
    #2 0x559fcbba2614 in ts_readstream /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:847:9
    #3 0x559fcbba3e74 in ts_get_more_data /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:1098:9
    #4 0x559fcbb71013 in general_loop /tmp/ccextractor-parent/src/lib_ccx/general_loop.c:1443:9
    #5 0x559fcb9c8f13 in start_ccx /tmp/ccextractor-parent/src/ccextractor.c:199:11
    #6 0x7f269b227780 in __libc_start_call_main (/usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:59:16)
    #7 0x7f269b2278b8 in __libc_start_main (/usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:372:3)
    #8 0x559fcb82dfc4 in _start (/tmp/ccextractor-parent/build-asan/ccextractor+0x174fc4) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)

0x7c26841e9b43 is located 3915 bytes after 184-byte region [0x7c26841e8b40,0x7c26841e8bf8)
allocated by thread T0 here:
    #0 0x559fcb8e1394 in malloc (/tmp/ccextractor-parent/build-asan/ccextractor+0x228394) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)
    #1 0x559fcbba8814 in ts_buffer_psi_packet /tmp/ccextractor-parent/src/lib_ccx/ts_tables.c:590:46
    #2 0x559fcbba257e in ts_readstream /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:845:4
    #3 0x559fcbba3e74 in ts_get_more_data /tmp/ccextractor-parent/src/lib_ccx/ts_functions.c:1098:9
    #4 0x559fcbb71013 in general_loop /tmp/ccextractor-parent/src/lib_ccx/general_loop.c:1443:9
    #5 0x559fcb9c8f13 in start_ccx /tmp/ccextractor-parent/src/ccextractor.c:199:11
    #6 0x7f269b227780 in __libc_start_call_main (/usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:59:16)
    #7 0x7f269b2278b8 in __libc_start_main (/usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:372:3)
    #8 0x559fcb82dfc4 in _start (/tmp/ccextractor-parent/build-asan/ccextractor+0x174fc4) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/tmp/ccextractor-parent/build-asan/ccextractor+0x225f53) (BuildId: e6eef4c3fe76d03bb70bfcaa782da599722b0bb6) in __asan_memmove
Shadow bytes around the buggy address:
  0x7c26841e9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7c26841e9b00: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa
  0x7c26841e9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c26841e9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==163035==ABORTING

The section should be rejected when c0length + 3 > len, and len should be reduced by c0length + 3 after the move. I have a minimal patch that does both and can open a PR.

Lingua principale
C
Stelle
908
Fork
595
Merge medio
3g 6h
PR unite (30g)
31

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di CCExtractor/ccextractor

Tutte le issue di CCExtractor/ccextractor

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.