Repository navigation
[FIX] Stop reading past the end of the credits text in WebVTT, SAMI and SMPTE-TT - #2400
Open
Deepak-negi11 wants to merge 1 commit into
Open
Deepak-negi11 wants to merge 1 commit into
Deepak-negi11 wants to merge 1 commit into
Conversation
…nd SMPTE-TT write_stringz_as_webvtt/sami/smptett unescape "\n" into a NUL, which writes fewer bytes (pos_w) than the input length (len), but then read the segments back while begin < unescaped + len. With --startcreditstext 'Alpha\nBravo\nCharlie' this reads past the written data and off the end of the buffer (AddressSanitizer: heap-buffer-overflow in encode_line). Bound the read-back by pos_w. The pos_r < len - 1 check in the escape test is not a fix (at the last character string[pos_r + 1] is the terminating NUL); it keeps the code the same as ccx_encoders_srt.c after CCExtractor#2128. The SAMI and SMPTE-TT functions also write every normal text subtitle. Their output doesn't change: without a literal "\n", pos_w equals len. The SSA writer has the same bug; it is left to CCExtractor#2316, which rewrites that function.
Deepak-negi11
force-pushed
the
fix/credits-read-past-end
branch
from
October 18, 2026 18:15
547f7cc to
a54f6c7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In raising this pull request, I confirm the following (please check boxes):
Reason for this PR:
Sanity check:
Repro instructions:
Sample:
Closed Caption EIA.tsfrom https://streams.videolan.org/streams/ts/ (CC/wabc-4pm-ota.clip1.tsalso works). Build with AddressSanitizer (-fsanitize=address) to see the error.ccextractor --out=webvtt --startcreditstext 'Alpha\nBravo\nCharlie' sample.ts--out=sami--out=smptettProblem
These writers turn every
\nin the credits text (2 characters) into a line break (1 character), so the result is shorter than the input. But they then read the result back using the input's length, so they read past the end of the data. This is the same bug you described for SSA in the #2316 review.Fix
Read back only what was written. This is the same two-line fix #2128 made in the SRT writer. SSA has the same bug, but #2316 rewrites that function, so I didn't touch it.
Testing
Notes:
\nin the text, both lengths are equal.pos_r < len - 1change isn't a bug fix (at the last character,string[pos_r + 1]is the string's ending zero). It just keeps the code the same as the SRT writer after Fix potential out-of-bounds access in write_stringz_as_srt_to_output #2128.