[FIX] Out-of-bounds read: unsigned underflow defeats the file buffer bounds checks by cfsmp3 · Pull Request #2322 · CCExtractor/ccextractor

cfsmp3 · 2026-08-12T22:46:49Z

A WTV recording makes ccextractor read ~2.3 GB past a 1 MB buffer and segfault. The buffer bounds check that should have stopped it is defeated by unsigned arithmetic.

Root cause

buffered_seek() handles a negative offset like this:

ctx->filebuffer_pos += offset;
if (ctx->filebuffer_pos < 0)
{
	if ((ctx->filebuffer_pos + ctx->startbytes_pos) < 0)
		fatal(CCX_COMMON_EXIT_BUG_BUG, "PANIC: Attempt to seek before buffer start, this is a bug!");
	...
}

filebuffer_pos and startbytes_pos are both unsigned int, so the addition wraps instead of going negative and neither guard can ever be true. The "seek before buffer start" path is dead code.

A backward seek past the start of the buffer therefore leaves filebuffer_pos at roughly 2^32. buffered_read() then evaluates

if (bytes <= ctx->bytesinbuffer - ctx->filebuffer_pos)

which underflows for the same reason, so the bounds check passes and memcpy() reads from far outside the buffer.

Observed

On 5f6dfe831e35…wtv the WTV parser reaches buffered_seek(ctx, -1969339576) while filebuffer_pos is 1048576. Values captured at the fault:

bytes                          = 32
ctx->bytesinbuffer             = 1048576        (1 MB)
ctx->filebuffer_pos            = 2326676296     (wrapped)
bytesinbuffer - filebuffer_pos = 1969339576     (underflow -> check passes)

memcpy(dst, ctx->filebuffer + 2326676296, 32)   -> SIGSEGV

Fix

Do the seek arithmetic in int64_t so both existing guards work as written, and route the buffer-space checks through a small buffered_bytes_left() helper that returns 0 when the position is past the end.

Three call sites shared the hazard, so all three are converted:

buffered_read() — the crash above
buffered_skip() — same comparison
buffered_read_byte() — if (ctx->bytesinbuffer - ctx->filebuffer_pos) would be truthy on underflow and index filebuffer[] out of bounds

Input files are untrusted, so this is a bounds-check fix rather than only a crash fix.

Verification

The sample no longer performs an out-of-bounds read. The previously unreachable guard now fires and the file is rejected cleanly (PANIC: Attempt to seek before buffer start) instead of faulting.
No captions are lost: master (before crashing) and this branch both write the same 8662-byte output with 100 cues.
ASan on the fixed build reports no SEGV and no invalid access on that file.
55 media files swept (ts, mpg, wtv, mp4, mkv, mxf): output byte-identical to master in every case, with no exit-code changes.

What the remaining PANIC means

With this fix the sample no longer reads out of bounds; the guard that was previously dead now fires:

Error: PANIC: Attempt to seek before buffer start, this is a bug!

That message is accurate and should stay: reaching it means an invariant really was broken, and the invariant was broken by our own code rather than by the input.

Tracing the caller shows why. get_data() reads a 32-bit element length straight from the file and does len -= 32 with no check that len >= 32, then passes len + pad to skip_sized_buffer(uint32_t size), which calls buffered_seek(ctx, size) — and that parameter is an int. The observed size was 2325627720, which is above INT_MAX, so the conversion produced -1969339576 (2325627720 - 2^32). A forward skip silently became a 1.8 GB backward seek.

For the avoidance of doubt, the input is not meaningfully damaged: ffprobe reports a well-formed WTV with four streams and a 358 s duration matching the file size, and ffmpeg decodes the whole file to completion with exit 0 (a couple of localized glitches typical of a broadcast capture, nothing structural). The file is 0.34 GiB, so a 1.8 GiB backward seek could never have been legitimate.

Fixing that properly means validating the parsed length and not narrowing a uint32_t into an int seek. That is a WTV-parser change and belongs in its own PR; this one stops the out-of-bounds read for every caller of the buffer layer.

…passes buffered_seek() handled a negative offset with ctx->filebuffer_pos += offset; if (ctx->filebuffer_pos < 0) but filebuffer_pos is unsigned int, so the addition wraps instead of going negative and the check can never be true. The guard below it compares filebuffer_pos + startbytes_pos against 0 and is dead for the same reason, so the "seek before buffer start" fatal() is unreachable. Seeking back further than the current position therefore left filebuffer_pos at roughly 2^32. buffered_read() then evaluated bytes <= ctx->bytesinbuffer - ctx->filebuffer_pos which underflows too, so the bounds check passed and memcpy() read from filebuffer + 2.3e9 against a 1 MB buffer. Observed on a malformed WTV file, where a corrupt chunk offset produces buffered_seek(ctx, -1969339576) with filebuffer_pos = 1048576: filebuffer_pos -> 2326676296 bytesinbuffer = 1048576 bytesinbuffer - filebuffer_pos = 1969339576 (underflow) memcpy(dst, filebuffer + 2326676296, 32) -> SIGSEGV Do the seek arithmetic in int64_t so both guards work as written, and route the three buffer-space checks through a buffered_bytes_left() helper that returns 0 when the position is past the end. buffered_read_byte() had the same hazard and would have indexed filebuffer[] out of bounds. Input files are untrusted, so this is a bounds-check fix, not only a crash fix.

MSVC warns C4267 on "filebuffer_pos += bytes": filebuffer_pos is an unsigned int and bytes is a size_t. The warning predates this branch -- it fires 54 times on master -- but the guard this commit series added is what makes the conversion provably safe, so state that in the code instead of leaving a warning that a reader has to re-derive. bytes is known to be no larger than what is left of the buffer, and that remainder is itself an unsigned int, so the value always fits.

ccextractor-bot · 2026-08-13T08:00:46Z

CCExtractor CI platform finished running the test files on linux. Below is a summary of the test results, when compared to test for commit b67effd...:

Report Name	Tests Passed
Broken	9/13
CEA-708	2/14
DVB	0/7
DVD	3/3
DVR-MS	2/2
General	22/27
Hardsubx	1/1
Hauppage	3/3
MP4	3/3
NoCC	10/10
Options	69/86
Teletext	0/21
WTV	12/13
XDS	31/34

NOTE: The following tests have been failing on the master branch as well as the PR:

ccextractor --out=srt --latin1 --autoprogram 73d9313d64..., Last passed:
Test 8738
ccextractor --out=ttxt --latin1 001dd8cdf7..., Last passed:
Test 8738
ccextractor --out=srt --latin1 611b4a9235..., Last passed:
Test 9442
ccextractor --out=srt --latin1 4d4e938ef6..., Last passed:
Test 8738
ccextractor --service 1 --out=txt --no-bom --no-rollup ea83ff7bcb..., Last passed:
Test 8738
ccextractor --service 1 --out=txt f17524b53f..., Last passed:
Test 8738
ccextractor --service 1 --out=txt 80848c45f8..., Last passed:
Test 8738
ccextractor --service 1 --out=txt --no-bom --no-rollup b5d6aad89f..., Last passed:
Test 8738
ccextractor --service 1[EUC-KR] --out=txt --no-rollup b5d6aad89f..., Last passed:
Test 8738
ccextractor --service 1 --out=srt da904de35d..., Last passed:
Test 8738
ccextractor --service 1 --out=sami da904de35d..., Last passed:
Test 8738
ccextractor --service 1[EUC-KR] b5d6aad89f..., Last passed:
Test 8738
ccextractor --service 1[EUC-KR] --no-rollup b5d6aad89f..., Last passed:
Test 8738
ccextractor --service all da904de35d..., Last passed:
Test 8738
ccextractor --service all[EUC-KR] b5d6aad89f..., Last passed:
Test 8738
ccextractor --service 1,2[UTF-8],3[EUC-KR],54 --out=txt da904de35d..., Last passed:
Test 8738
ccextractor --autoprogram --out=ttxt --latin1 1020459a86..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 f1422b8bfe..., Last passed:
Test 9208
ccextractor --datapid 5603 --autoprogram --out=srt --latin1 --teletext 85c7fc1ad7..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 d41b53b504..., Last passed:
Test 8738
ccextractor --stdout --quiet --no-fontcolor 79a51f3500..., Last passed:
Test 8738
ccextractor --stdout --quiet --no-fontcolor 767b546f96..., Last passed:
Test 8738
ccextractor --autoprogram --out=srt --latin1 --quant 0 85271be4d2..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 132d7df7e9..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 99e5eaafdc..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 --ucla dab1c1bd65..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 01509e4d27..., Last passed:
Test 9442
ccextractor --out=srt --latin1 --autoprogram 29e5ffd34b..., Last passed:
Test 9442
ccextractor --service 1 c83f765c66..., Last passed:
Test 8738
ccextractor --out=spupng c83f765c66..., Last passed:
Test 9442
ccextractor --myth c83f765c66..., Last passed:
Test 8738
ccextractor --dru c83f765c66..., Last passed:
Test 9442
ccextractor --startat 4 --endat 7 c83f765c66..., Last passed:
Test 9442
ccextractor --in=raw fb79021542..., Last passed:
Test 8738
ccextractor --mp4vidtrack 5df914ce77..., Last passed:
Test 8738
ccextractor --codec dvbsub --out=spupng 85271be4d2..., Last passed:
Test 9442
ccextractor --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9442
ccextractor --startcreditsnotbefore 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9442
ccextractor --startcreditsnotafter 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9442
ccextractor --startcreditsforatleast 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9442
ccextractor --startcreditsforatmost 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9442
ccextractor --tpage 801 4e56e88ba4..., Last passed:
Test 9442
ccextractor --tverbose 4e56e88ba4..., Last passed:
Test 9442
ccextractor --teletext 4e56e88ba4..., Last passed:
Test 9442
ccextractor --xmltv=3 --out=null 96efd279cf..., Last passed:
Test 8738
ccextractor --datapid 2310 --autoprogram --out=srt --latin1 e639e54550..., Last passed:
Test 8738
ccextractor --autoprogram --out=srt --latin1 4e56e88ba4..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 c0d2fba8c0..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 006fdc391a..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 e92a1d4d2a..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 b37ce60eb9..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 7e4ebf7fd7..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 9256a60e4b..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 27d7a43dd6..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 297a44921a..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 efbe129086..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 eae0077731..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 e2e2b501e0..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 8c1615c1a8..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 c6407fb294..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 --datets dcada745de..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --tpage 398 5d5838bde9..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --tpage 299 44c45593fb..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --tpage 299 b8c55aa2e9..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --teletext --tpage 398 3b276ad8bf..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 b236a0590b..., Last passed:
Test 9442
ccextractor --out=srt --latin1 f23a544ba8..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --ucla d037c7509e..., Last passed:
Test 9442
ccextractor --autoprogram --out=srt --latin1 --ucla 7d3f25c32c..., Last passed:
Test 9442
ccextractor --autoprogram --out=ttxt --latin1 --ucla --xds 7f41299cc7..., Last passed:
Test 9442

This PR does not introduce any new test failures. However, some tests are failing on both master and this PR (see above).

Check the result page for more info.

ccextractor-bot · 2026-08-13T08:21:24Z

CCExtractor CI platform finished running the test files on windows. Below is a summary of the test results, when compared to test for commit b67effd...:

Report Name	Tests Passed
Broken	9/13
CEA-708	2/14
DVB	0/7
DVD	3/3
DVR-MS	2/2
General	22/27
Hardsubx	1/1
Hauppage	3/3
MP4	3/3
NoCC	10/10
Options	69/86
Teletext	0/21
WTV	12/13
XDS	31/34

NOTE: The following tests have been failing on the master branch as well as the PR:

ccextractor --out=srt --latin1 --autoprogram 73d9313d64..., Last passed:
Test 8611
ccextractor --out=ttxt --latin1 001dd8cdf7..., Last passed:
Test 8611
ccextractor --out=srt --latin1 611b4a9235..., Last passed:
Test 9441
ccextractor --out=srt --latin1 4d4e938ef6..., Last passed:
Test 8611
ccextractor --service 1 --out=txt --no-bom --no-rollup ea83ff7bcb..., Last passed:
Test 8611
ccextractor --service 1 --out=txt f17524b53f..., Last passed:
Test 8611
ccextractor --service 1 --out=txt 80848c45f8..., Last passed:
Test 8611
ccextractor --service 1 --out=txt --no-bom --no-rollup b5d6aad89f..., Last passed:
Test 8611
ccextractor --service 1[EUC-KR] --out=txt --no-rollup b5d6aad89f..., Last passed:
Test 8611
ccextractor --service 1 --out=srt da904de35d..., Last passed:
Test 8611
ccextractor --service 1 --out=sami da904de35d..., Last passed:
Test 8611
ccextractor --service 1[EUC-KR] b5d6aad89f..., Last passed:
Test 8611
ccextractor --service 1[EUC-KR] --no-rollup b5d6aad89f..., Last passed:
Test 8611
ccextractor --service all da904de35d..., Last passed:
Test 8611
ccextractor --service all[EUC-KR] b5d6aad89f..., Last passed:
Test 8611
ccextractor --service 1,2[UTF-8],3[EUC-KR],54 --out=txt da904de35d..., Last passed:
Test 8611
ccextractor --autoprogram --out=ttxt --latin1 1020459a86..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 f1422b8bfe..., Last passed:
Test 9209
ccextractor --datapid 5603 --autoprogram --out=srt --latin1 --teletext 85c7fc1ad7..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 d41b53b504..., Last passed:
Test 8611
ccextractor --stdout --quiet --no-fontcolor 79a51f3500..., Last passed:
Test 8611
ccextractor --stdout --quiet --no-fontcolor 767b546f96..., Last passed:
Test 8611
ccextractor --autoprogram --out=srt --latin1 --quant 0 85271be4d2..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 132d7df7e9..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 99e5eaafdc..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 --ucla dab1c1bd65..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 01509e4d27..., Last passed:
Test 9441
ccextractor --out=srt --latin1 --autoprogram 29e5ffd34b..., Last passed:
Test 9441
ccextractor --service 1 c83f765c66..., Last passed:
Test 8611
ccextractor --out=spupng c83f765c66..., Last passed:
Test 9441
ccextractor --myth c83f765c66..., Last passed:
Test 8611
ccextractor --dru c83f765c66..., Last passed:
Test 9441
ccextractor --startat 4 --endat 7 c83f765c66..., Last passed:
Test 9441
ccextractor --in=raw fb79021542..., Last passed:
Test 8611
ccextractor --mp4vidtrack 5df914ce77..., Last passed:
Test 8611
ccextractor --codec dvbsub --out=spupng 85271be4d2..., Last passed:
Test 9441
ccextractor --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9441
ccextractor --startcreditsnotbefore 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9441
ccextractor --startcreditsnotafter 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9441
ccextractor --startcreditsforatleast 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9441
ccextractor --startcreditsforatmost 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9..., Last passed:
Test 9441
ccextractor --tpage 801 4e56e88ba4..., Last passed:
Test 9441
ccextractor --tverbose 4e56e88ba4..., Last passed:
Test 9441
ccextractor --teletext 4e56e88ba4..., Last passed:
Test 9441
ccextractor --xmltv=3 --out=null 96efd279cf..., Last passed:
Test 8611
ccextractor --datapid 2310 --autoprogram --out=srt --latin1 e639e54550..., Last passed:
Test 8611
ccextractor --autoprogram --out=srt --latin1 4e56e88ba4..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 c0d2fba8c0..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 006fdc391a..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 e92a1d4d2a..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 b37ce60eb9..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 7e4ebf7fd7..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 9256a60e4b..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 27d7a43dd6..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 297a44921a..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 efbe129086..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 eae0077731..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 e2e2b501e0..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 8c1615c1a8..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 c6407fb294..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 --datets dcada745de..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --tpage 398 5d5838bde9..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --tpage 299 44c45593fb..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --tpage 299 b8c55aa2e9..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --teletext --tpage 398 3b276ad8bf..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 b236a0590b..., Last passed:
Test 9441
ccextractor --out=srt --latin1 f23a544ba8..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --ucla d037c7509e..., Last passed:
Test 9441
ccextractor --autoprogram --out=srt --latin1 --ucla 7d3f25c32c..., Last passed:
Test 9441
ccextractor --autoprogram --out=ttxt --latin1 --ucla --xds 7f41299cc7..., Last passed:
Test 9441

This PR does not introduce any new test failures. However, some tests are failing on both master and this PR (see above).

Check the result page for more info.

cfsmp3 mentioned this pull request Aug 13, 2026

[FIX] WTV: resynchronise instead of trusting an implausible element length #2323

Merged

Navigation Menu

Uh oh!

[FIX] Out-of-bounds read: unsigned underflow defeats the file buffer bounds checks - #2322

[FIX] Out-of-bounds read: unsigned underflow defeats the file buffer bounds checks#2322
cfsmp3 wants to merge 2 commits into
masterfrom
fix/buffered-seek-unsigned-underflow

cfsmp3 commented Aug 12, 2026 •

edited

Loading

Uh oh!

ccextractor-bot commented Aug 13, 2026

Uh oh!

ccextractor-bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cfsmp3 commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Observed

Fix

Verification

What the remaining PANIC means

Related

Uh oh!

ccextractor-bot commented Aug 13, 2026

Uh oh!

ccextractor-bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cfsmp3 commented Aug 12, 2026 •

edited

Loading