Skip to content

fix: resolve dangling pointer in switch_output_file#2286

Open
TacoJr01 wants to merge 1 commit into
CCExtractor:masterfrom
TacoJr01:fix/switch-output-file-dangling-pointer
Open

fix: resolve dangling pointer in switch_output_file#2286
TacoJr01 wants to merge 1 commit into
CCExtractor:masterfrom
TacoJr01:fix/switch-output-file-dangling-pointer

Conversation

@TacoJr01

Copy link
Copy Markdown

Free old filename/fh only after new file is successfully opened. Uses prepare-then-swap pattern to avoid partial state where encoder has no valid output. Fixes #2273

In raising this pull request, I confirm the following (please check boxes):

Reason for this PR:

  • This PR adds new functionality.
  • This PR fixes a bug that I have personally experienced or that a real user has reported and for which a sample exists.
  • This PR is porting code from C to Rust.

Sanity check:

  • I have read and understood the contributors guide.
  • I have checked that another pull request for this purpose does not exist.
  • If the PR adds new functionality, I've added it to the changelog. If it's just a bug fix, I have NOT added it to the changelog.
  • I am NOT adding new C code unless it's to fix an existing, reproducible bug.

Repro instructions:

This is essential. We will not merge ANY PR that doesn't come with detailed instructions, including a sample. We don't want
"fixes" for theoretical issues that an AI agent found, without context. If you can't reproduce the bug, don't send a PR.

Creating PRs with AI is very quick, but we still have humans (even if AI assisted) going over each.

Be mindful of reviewers' time.


Fixes #2273

Problem:

In switch_output_file, enc_ctx->out->filename was freed before confirming a new file could be successfully opened. If get_basename() or open() failed, the function would proceed with a dangling pointer being passed to write_subtitle_file_header(), causing undefined behavior.

Fix:

Uses a prepare-then-swap approach — the new filename and file descriptor are fully prepared first. The old values are only freed and replaced after the new file is confirmed open. If any step fails, the function returns early leaving the encoder context in its original valid state.
Testing:

Tested on multiprogram_spain.ts (multiprogram transport stream with 7 programs) — processed all programs without crashing and produced expected output.

Free old filename/fh only after new file is successfully opened.
Uses prepare-then-swap pattern to avoid partial state where encoder
has no valid output. Fixes CCExtractor#2273
@ccextractor-bot

Copy link
Copy Markdown
Collaborator
CCExtractor CI platform finished running the test files on linux. Below is a summary of the test results, when compared to test for commit 2feb09a...:
Report Name Tests Passed
Broken 0/13
CEA-708 2/14
DVB 0/7
DVD 3/3
DVR-MS 0/2
General 9/27
Hardsubx 1/1
Hauppage 3/3
MP4 3/3
NoCC 10/10
Options 72/86
Teletext 20/21
WTV 12/13
XDS 31/34

Your PR breaks these cases:

  • ccextractor --autoprogram --out=srt --latin1 1d9731bd80...
  • ccextractor --out=sami --latin1 --autoprogram --no-goptime 5b4e0a6034...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla --xds 8e8229b88b...
  • ccextractor --autoprogram --out=ttxt --latin1 7236304cfc...
  • ccextractor --out=srt --latin1 06b3a9237d...
  • ccextractor --out=srt --latin1 83f8cceb74...
  • ccextractor --out=srt --latin1 611b4a9235...
  • ccextractor --out=srt --latin1 b46e9e8e3f...
  • ccextractor --out=srt --latin1 89e417e622...
  • ccextractor --out=srt --latin1 d59eadc4ed...
  • ccextractor --autoprogram --out=ttxt --latin1 1020459a86...
  • ccextractor --datapid 5603 --autoprogram --out=srt --latin1 --teletext 85c7fc1ad7...
  • ccextractor --autoprogram --out=srt --latin1 --quant 0 85271be4d2...
  • ccextractor --wtvconvertfix --autoprogram --out=srt --latin1 acf871cbfd...
  • ccextractor --wtvconvertfix --autoprogram --out=srt --latin1 5cbb21adb6...
  • ccextractor --autoprogram --out=ttxt --latin1 99e5eaafdc...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 7aad20907e...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 5d3a29f9f8...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 70000200c0...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 6dc772d881...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla dab1c1bd65...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla adce82fd39...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 15feae9133...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla 95dd33c6f1...
  • ccextractor --autoprogram --out=ttxt --latin1 01509e4d27...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla ab9cf8cfad...
  • ccextractor --autoprogram --out=srt --latin1 15feae9133...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla --output-field 2 5d3a29f9f8...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla --output-field 2 c41f73056a...
  • ccextractor --autoprogram --out=srt --latin1 --sentencecap c032183ef0...
  • ccextractor --autoprogram --out=bin --latin1 c032183ef0...
  • ccextractor --out=srt --latin1 --autoprogram 29e5ffd34b...
  • ccextractor --out=spupng c83f765c66...
  • ccextractor --dru c83f765c66...
  • ccextractor --startat 4 --endat 7 c83f765c66...
  • ccextractor --codec dvbsub --out=spupng 85271be4d2...
  • ccextractor --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9...
  • ccextractor --startcreditsnotbefore 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9...
  • ccextractor --startcreditsnotafter 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9...
  • ccextractor --startcreditsforatleast 1 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9...
  • ccextractor --startcreditsforatmost 2 --startcreditstext "CCextractor Start crdit Testing" c4dd893cb9...
  • ccextractor --out=srt --latin1 f23a544ba8...
  • ccextractor --autoprogram --out=srt --latin1 --ucla d037c7509e...
  • ccextractor --autoprogram --out=srt --latin1 --ucla 7d3f25c32c...
  • ccextractor --autoprogram --out=ttxt --latin1 --ucla --xds 7f41299cc7...

NOTE: The following tests have been failing on the master branch as well as the PR:

Congratulations: Merging this PR would fix the following tests:

  • ccextractor --service 1 --out=ttxt da904de35d..., Last passed: Never
  • ccextractor --autoprogram --out=ttxt --latin1 132d7df7e9..., Last passed: Never

It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you).

Check the result page for more info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Use-After-Free in switch_output_file due to dangling pointer when get_basename fails

2 participants