From 0ba941e8c0bd81ac973d5ad86fab99282c60259a Mon Sep 17 00:00:00 2001 From: Amrit kumar Mahto Date: Tue, 30 Dec 2025 05:27:23 +0530 Subject: [PATCH 1/2] ts: prevent heap buffer overflow in Teletext demux path --- src/lib_ccx/ts_functions.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/lib_ccx/ts_functions.c b/src/lib_ccx/ts_functions.c index 12702dc4c..6823b3e80 100644 --- a/src/lib_ccx/ts_functions.c +++ b/src/lib_ccx/ts_functions.c @@ -568,6 +568,13 @@ int copy_capbuf_demux_data(struct ccx_demuxer *ctx, struct demuxer_data **data, if (cinfo->codec == CCX_CODEC_TELETEXT) { + if (cinfo->capbuflen > BUFSIZE - ptr->len) + { + fatal(CCX_COMMON_EXIT_BUG_BUG, + "Teletext packet (%ld) larger than remaining buffer (%lld).\n", + cinfo->capbuflen, BUFSIZE - ptr->len); + } + memcpy(ptr->buffer + ptr->len, cinfo->capbuf, cinfo->capbuflen); ptr->len += cinfo->capbuflen; return CCX_OK; From 125c5e88218552f3e8d4154dd44a822609f18a15 Mon Sep 17 00:00:00 2001 From: Amrit Kumar Mahto Date: Tue, 30 Dec 2025 15:13:19 +0530 Subject: [PATCH 2/2] Update ts_functions.c --- src/lib_ccx/ts_functions.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/lib_ccx/ts_functions.c b/src/lib_ccx/ts_functions.c index 6823b3e80..683c4fcf5 100644 --- a/src/lib_ccx/ts_functions.c +++ b/src/lib_ccx/ts_functions.c @@ -6,6 +6,7 @@ #include "dvb_subtitle_decoder.h" #include "ccx_decoders_isdb.h" #include "file_buffer.h" +#include #ifdef DEBUG_SAVE_TS_PACKETS #include @@ -571,8 +572,8 @@ int copy_capbuf_demux_data(struct ccx_demuxer *ctx, struct demuxer_data **data, if (cinfo->capbuflen > BUFSIZE - ptr->len) { fatal(CCX_COMMON_EXIT_BUG_BUG, - "Teletext packet (%ld) larger than remaining buffer (%lld).\n", - cinfo->capbuflen, BUFSIZE - ptr->len); + "Teletext packet (%" PRId64 ") larger than remaining buffer (%" PRId64 ").\n", + cinfo->capbuflen, (int64_t)(BUFSIZE - ptr->len)); } memcpy(ptr->buffer + ptr->len, cinfo->capbuf, cinfo->capbuflen);