[harshalsp07]

The CDP parser now checks that the declared caption triplets fit before the packet footer and that the copied bytes fit in the demuxer buffer. Malformed counts return CCX_EINVAL.

The parser previously trusted the 5-bit cc_count and could read beyond a short packet while copying caption data.

Added three cases to the repository Check suite: reject the issue’s malformed 16-byte CDP, accept a valid one-triplet CDP, and reject a write that exceeds the destination buffer.

Validation:

• An AddressSanitizer/UBSan harness compiled against ccx_gxf.c rejected the malformed packet, preserved all three caption bytes from a valid packet, and rejected insufficient destination capacity.
• The same harness against upstream/master reports an AddressSanitizer stack-buffer-overflow in the original copy loop.
• The added suite and runner pass a C syntax check. The Check library is not installed here, so the suite itself could not be run.
• git diff --check passed.
• CMake configuration could not complete because the required gpac package is not installed, so the full application build and end-to-end GXF repro remain unverified.