提交 #487029: Bento4 mp42aac 1.6.0 heap-buffer-overflow信息

标题Bento4 mp42aac 1.6.0 heap-buffer-overflow
描述The bug I found refers to "bug2.zip" in the given link. CMD: ``` ./mp42aac Bug2 /dev/null ``` OUTPUT: ``` ================================================================= ==11273==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000013c at pc 0x5578282fcbc7 bp 0x7ffd30564a40 sp 0x7ffd30564a30 READ of size 4 at 0x60200000013c thread T0 #0 0x5578282fcbc6 in AP4_DataBuffer::GetData() const /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4DataBuffer.h:56 #1 0x5578282fcbc6 in AP4_BitReader::ReadCache() const /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Utils.cpp:446 #2 0x5578282fcbc6 in AP4_BitReader::ReadBits(unsigned int) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Utils.cpp:467 #3 0x5578283fb525 in AP4_Dac4Atom::AP4_Dac4Atom(unsigned int, unsigned char const*) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Dac4Atom.cpp:201 #4 0x5578283ff347 in AP4_Dac4Atom::Create(unsigned int, AP4_ByteStream&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4Dac4Atom.cpp:58 #5 0x557828369276 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:776 #6 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #7 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #8 0x5578282d9601 in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:115 #9 0x5578282d9601 in AP4_AudioSampleEntry::AP4_AudioSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:420 #10 0x5578282d9601 in AP4_Ac4SampleEntry::AP4_Ac4SampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4SampleEntry.cpp:801 #11 0x55782836a989 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:342 #12 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #13 0x5578282e8d34 in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4StsdAtom.cpp:102 #14 0x5578282ea629 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4StsdAtom.cpp:57 #15 0x55782836905d in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:458 #16 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #17 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #18 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #19 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #20 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #21 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #22 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #23 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #24 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #25 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #26 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #27 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #28 0x5578283d7db0 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #29 0x5578283d7db0 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:88 #30 0x5578283672b9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:816 #31 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #32 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #33 0x5578283d748d in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #34 0x5578282f3f17 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4TrakAtom.cpp:165 #35 0x55782836841f in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4TrakAtom.h:58 #36 0x55782836841f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:413 #37 0x557828370254 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #38 0x5578283d6eac in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:196 #39 0x5578283d748d in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4ContainerAtom.cpp:140 #40 0x55782827d012 in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4MoovAtom.cpp:80 #41 0x55782836b2d7 in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4MoovAtom.h:56 #42 0x55782836b2d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:393 #43 0x55782836ea69 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:234 #44 0x55782836ea69 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /experiments/programs_AFLplusplus/unibench/Bento4-newest/Source/C++/Core/Ap4AtomFactory.cpp:154 #45 0x557828276c41 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool)
来源⚠️ https://github.com/axiomatic-systems/Bento4/issues/980
用户
 SecRookie (UID 80567)
提交2025-01-22 04時07分 (2 年前)
管理2025-01-30 09時45分 (8 days later)
状态重复
VulDB条目294056 [Axiomatic Bento4 直到 1.6.0-641 Ap4DataBuffer.h AP4_DataBuffer::GetData 内存损坏]
积分0

Interested in the pricing of exploits?

See the underground prices here!