## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), `mp4info` (latest master `5922ba7`)

## **Command line**

`./mp4info @@ /dev/null`

## Output

```bash
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Frame::StartParseHiddenScan, line 869, file frame.cpp
*** Reason is: Start of Scan SOS marker missing
*** Warning -1038 in Frame::ParseTrailer, line 1085, file frame.cpp
*** Reason is: missing an EOI marker at the end of the stream
*** Warning -1038 in Image::ParseTrailer, line 1464, file image.cpp
*** Reason is: expecting an EOI marker at the end of the stream

[1]    4496 segmentation fault  ./jpeg -oz -h -s 1x1,2x2,2x2  /dev/null
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 60050
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
ASAN:SIGSEGV
=================================================================
==14253==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x0000004c3648 bp 0x7ffeebfc91f0 sp 0x7ffeebfc91d0 T0)
    #0 0x4c3647 in AP4_Stz2Atom::GetSampleSize(unsigned int, unsigned int&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:208
    #1 0x4fb16d in AP4_AtomSampleTable::GetSample(unsigned int, AP4_Sample&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:162
    #2 0x4cf21c in AP4_Track::GetSample(unsigned int, AP4_Sample&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Track.cpp:437
    #3 0x409aa3 in ScanMedia /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1270
    #4 0x40a169 in ShowTrackInfo_Text /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1331
    #5 0x40af2e in ShowTrackInfo /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475
    #6 0x40b54a in ShowTracks /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586
    #7 0x40ceee in main /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868
    #8 0x7fee9b9a383f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #9 0x401b28 in _start (/bigdata/AlphaFuzz-Experiment/results/crashes/mp4info/mp4info-asan+0x401b28)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:208 AP4_Stz2Atom::GetSampleSize(unsigned int, unsigned int&)
==14253==ABORTING
```

## POC
[SEGV_GetSampleSize_Ap4Stz2Atom208.zip](https://github.com/axiomatic-systems/Bento4/files/7274348/SEGV_GetSampleSize_Ap4Stz2Atom208.zip)


SEGV_GetSampleSize_Ap4Stz2Atom208
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : SEGV_GetSampleSize_Ap4Stz2Atom208
Issue date:

--- start body ---
## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), `mp4info` (latest master `5922ba7`)

## **Command line**

`./mp4info @@ /dev/null`

## Output

```bash
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Tables::ParseTables, line 1384, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range
*** Warning -1038 in Frame::StartParseHiddenScan, line 869, file frame.cpp
*** Reason is: Start of Scan SOS marker missing
*** Warning -1038 in Frame::ParseTrailer, line 1085, file frame.cpp
*** Reason is: missing an EOI marker at the end of the stream
*** Warning -1038 in Image::ParseTrailer, line 1464, file image.cpp
*** Reason is: expecting an EOI marker at the end of the stream

[1]    4496 segmentation fault  ./jpeg -oz -h -s 1x1,2x2,2x2  /dev/null
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 60050
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
ASAN:SIGSEGV
=================================================================
==14253==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x0000004c3648 bp 0x7ffeebfc91f0 sp 0x7ffeebfc91d0 T0)
    #0 0x4c3647 in AP4_Stz2Atom::GetSampleSize(unsigned int, unsigned int&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:208
    #1 0x4fb16d in AP4_AtomSampleTable::GetSample(unsigned int, AP4_Sample&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:162
    #2 0x4cf21c in AP4_Track::GetSample(unsigned int, AP4_Sample&) /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Track.cpp:437
    #3 0x409aa3 in ScanMedia /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1270
    #4 0x40a169 in ShowTrackInfo_Text /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1331
    #5 0x40af2e in ShowTrackInfo /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475
    #6 0x40b54a in ShowTracks /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586
    #7 0x40ceee in main /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868
    #8 0x7fee9b9a383f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #9 0x401b28 in _start (/bigdata/AlphaFuzz-Experiment/results/crashes/mp4info/mp4info-asan+0x401b28)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /bigdata/AlphaFuzz-Experiment/programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:208 AP4_Stz2Atom::GetSampleSize(unsigned int, unsigned int&)
==14253==ABORTING
```

## POC
[SEGV_GetSampleSize_Ap4Stz2Atom208.zip](https://github.com/axiomatic-systems/Bento4/files/7274348/SEGV_GetSampleSize_Ap4Stz2Atom208.zip)


--- end body ---

A segmentation fault (SIGSEGV) in the AP4_Stz2Atom::GetSampleSize function of Bento4 allows attackers to cause a Denial of Service (DoS) by providing a specially crafted MP4 file. This vulnerability can lead to application crashes when the mp4info tool processes invalid or malformed MP4 files.