Submit #487029: Bento4 mp42aac 1.6.0 heap-buffer-overflowinfo

TitleBento4 mp42aac 1.6.0 heap-buffer-overflow
DescriptionThe bug I found refers to "bug2.zip" in the given link. CMD: ``` ./mp42aac Bug2 /dev/null ``` OUTPUT: ``` ================================================================= ==11273==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000013c at pc 0x5578282fcbc7 bp 0x7ffd30564a40 sp 0x7ffd30564a30 READ of size 4 at 0x60200000013c thread T0 #0 0x5578282fcbc6 in AP4_DataBuffer::GetData() const /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4DataBuffer.h:56 #1 0x5578282fcbc6 in AP4_BitReader::ReadCache() const /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Utils.cpp:446 #2 0x5578282fcbc6 in AP4_BitReader::ReadBits(unsigned int) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Utils.cpp:467 #3 0x5578283fb525 in AP4_Dac4Atom::AP4_Dac4Atom(unsigned int, unsigned char const*) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Dac4Atom.cpp:201 #4 0x5578283ff347 in AP4_Dac4Atom::Create(unsigned int, AP4_ByteStream&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Dac4Atom.cpp:58 #5 0x557828369276 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:776 #6 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #7 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #8 0x5578282d9601 in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:115 #9 0x5578282d9601 in AP4_AudioSampleEntry::AP4_AudioSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:420 #10 0x5578282d9601 in AP4_Ac4SampleEntry::AP4_Ac4SampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:801 #11 0x55782836a989 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:342 #12 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #13 0x5578282e8d34 in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4StsdAtom.cpp:102 #14 0x5578282ea629 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4StsdAtom.cpp:57 #15 0x55782836905d in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:458 #16 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #17 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #18 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #19 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #20 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #21 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #22 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #23 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #24 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #25 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #26 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #27 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #28 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #29 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #30 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #31 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #32 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #33 0x5578283d748d in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #34 0x5578282f3f17 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4TrakAtom.cpp:165 #35 0x55782836841f in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4TrakAtom.h:58 #36 0x55782836841f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:413 #37 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #38 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #39 0x5578283d748d in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #40 0x55782827d012 in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4MoovAtom.cpp:80 #41 0x55782836b2d7 in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4MoovAtom.h:56 #42 0x55782836b2d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:393 #43 0x55782836ea69 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #44 0x55782836ea69 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:154 #45 0x557828276c41 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool)
Source⚠️ https://github.com/axiomatic-systems/Bento4/issues/980
User
 SecRookie (UID 80567)
Submission01/22/2025 04:07 (2 years ago)
Moderation01/30/2025 09:45 (8 days later)
StatusDuplicate
VulDB entry294056 [Axiomatic Bento4 up to 1.6.0-641 Ap4DataBuffer.h AP4_DataBuffer::GetData heap-based overflow]
Points0

Might our Artificial Intelligence support you?

Check our Alexa App!