Stack Buffer Overflow in ISDB-CC decoder parse_csi (ccx_decoders_isdb.c)

[THE-Amrit-mahto-05]

Description

A stack buffer overflow exists in the ISDB-CC decoder.

Component: ISDB-CC decoder
File: src/lib_ccx/ccx_decoders_isdb.c
Function: parse_csi

Problem

The function parse_csi uses a small stack buffer uint8_t arg[10] to store CSI command arguments.
The original code had a dangerous off-by-one error:

if (i >= (sizeof(arg)) + 1)

This allows writing 11 bytes into a 10-byte buffer, causing a stack buffer overflow.
An attacker or malformed subtitle could crash the program or corrupt memory.

Proposed Fix

• Corrected the loop boundary:

if (i >= sizeof(arg) - 1)

• Added a final bounds check:

if (i < sizeof(arg))
    arg[i] = *buf++;

• Improved logging for malformed CSI commands.

Impact

• Prevents stack memory corruption
• Prevents program crashes
• Keeps normal functionality intact