[vlc-commits] [Git][videolan/vlc][master] 3 commits: demux: ts: fix ATSC descriptor OOB read

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch master at VideoLAN / VLC


Commits:
b427bd77 by François Cartegnie at 2026-10-23T22:40:40+02:00
demux: ts: fix ATSC descriptor OOB read

refs #29940

- - - - -
e0d55c25 by François Cartegnie at 2026-10-23T22:40:40+02:00
demux: ts: fix leak on error of ATSC stt descriptor

- - - - -
0860cafc by François Cartegnie at 2026-10-23T22:40:40+02:00
demux: ts: fix potential ATSC NULL deref

- - - - -


1 changed file:

- modules/demux/mpeg/ts_psip.c


Changes:

=====================================
modules/demux/mpeg/ts_psip.c
=====================================
@@ -338,6 +338,9 @@ static vlc_epg_event_t * ATSC_CreateVLCEPGEvent( demux_t *p_demux, ts_psip_conte
 #ifndef ATSC_DEBUG_EIT
     VLC_UNUSED(p_demux);
 #endif
+    if( !p_basectx->p_stt || !p_basectx->p_a65 )
+        return NULL;
+
     char *psz_title = atsc_a65_Decode_multiple_string( p_basectx->p_a65,
                                                        p_evt->i_title, p_evt->i_title_length );
     char *psz_shortdesc_text = NULL;
@@ -356,6 +359,8 @@ static vlc_epg_event_t * ATSC_CreateVLCEPGEvent( demux_t *p_demux, ts_psip_conte
             {
                 const uint8_t *p_data = p_dr->p_data;
                 size_t i_data = p_dr->i_length;
+                if( i_data < 4 )
+                    continue;
                 uint8_t i_ratings_count = p_dr->p_data[0] & 0x3F;
                 p_data++; i_data--;
                 for( ; i_ratings_count && i_data > 3; i_ratings_count-- )
@@ -541,10 +546,16 @@ static void ATSC_ETT_Callback( void *p_pid, dvbpsi_atsc_ett_t *p_ett )
     demux_t *p_demux = (demux_t *) p_ett_pid->u.p_psip->p_ctx->p_handle->p_sys;
     demux_sys_t *p_sys = p_demux->p_sys;
     ts_pid_t *p_base_pid = GetPID(p_sys, ATSC_BASE_PID);
+    if( unlikely(p_base_pid->type != TYPE_PSIP ) )
+    {
+        dvbpsi_atsc_DeleteETT( p_ett );
+        return;
+    }
+
     ts_psip_t *p_basepsip = p_base_pid->u.p_psip;
     ts_psip_context_t *p_basectx = p_basepsip->p_ctx;
 
-    if( p_ett->i_etm_id & 0x02 ) /* Event ETT */
+    if( (p_ett->i_etm_id & 0x02) && p_basectx->p_vct && p_basectx->p_mgt ) /* Event ETT */
     {
         ts_psip_context_t *p_ctx = p_ett_pid->u.p_psip->p_ctx;
         uint16_t i_vchannel_id, i_event_id;
@@ -810,7 +821,7 @@ static void ATSC_STT_Callback( void *p_cb_basepid, dvbpsi_atsc_stt_t* p_stt )
         {
             msg_Err( p_demux, "Can't attach MGT decoder to pid %d", ATSC_BASE_PID );
             ATSC_Detach_Dvbpsi_Decoders( p_handle );
-            dvbpsi_atsc_DeleteSTT( p_ctx->p_stt );
+            dvbpsi_atsc_DeleteSTT( p_stt );
             p_stt = NULL;
         }
     }



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ed4ca71a3a18a9788c8c830eaae5389ee08c7692...0860cafcd19d4dac5947024978bc74b57d223b42

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ed4ca71a3a18a9788c8c830eaae5389ee08c7692...0860cafcd19d4dac5947024978bc74b57d223b42
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help