## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), Bento4 (latest master [8a2bf3](https://github.com/axiomatic-systems/Bento4/commit/8a2bf3081e610bc145e8df3b10671dad839dd007))

## **Command line**

mp4info --show-layout --show-samples --show-sample-data @@

## Output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp42
  compatible brand: isoY
  fast start:       no

Movie:
  duration:   0 (media timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           -16777215
  type:         Unknown []
  duration: 0 ms
  language: eng
  media:
    sample count: 0
    timescale:    65521
    duration:     12 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
  Sample Description 0
    Coding:       hvc1 (H.265)
[1]    58362 segmentation fault   --show-layout --show-samples --show-sample-data
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp42
  compatible brand: isoY
  fast start:       no

Movie:
  duration:   0 (media timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           -16777215
  type:         Unknown []
  duration: 0 ms
  language: eng
  media:
    sample count: 0
    timescale:    65521
    duration:     12 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
  Sample Description 0
    Coding:       hvc1 (H.265)
ASAN:SIGSEGV
=================================================================
==44412==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd79729f68 (pc 0x0000004a27e2 bp 0x7ffd7972a0d0 sp 0x7ffd79729f50 T0)
    #0 0x4a27e1 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:608
    #1 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #2 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #3 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #4 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #5 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #6 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #7 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #8 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    ...
    #248 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #249 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #250 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #251 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171

SUMMARY: AddressSanitizer: stack-overflow ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:608 AP4_HevcSampleDescription::GetCodecString(AP4_String&)
==44412==ABORTING
```

## POC
[StackOverflow-GetCodecString-Ap4SampleDescription_cpp-612.zip](https://github.com/axiomatic-systems/Bento4/files/6852609/StackOverflow-GetCodecString-Ap4SampleDescription_cpp-612.zip)


StackOverflow-AP4_HevcSampleDescription::GetCodecString-Ap4SampleDescription-612
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : StackOverflow-AP4_HevcSampleDescription::GetCodecString-Ap4SampleDescription-612
Issue date:

--- start body ---
## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), Bento4 (latest master [8a2bf3](https://github.com/axiomatic-systems/Bento4/commit/8a2bf3081e610bc145e8df3b10671dad839dd007))

## **Command line**

mp4info --show-layout --show-samples --show-sample-data @@

## Output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp42
  compatible brand: isoY
  fast start:       no

Movie:
  duration:   0 (media timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           -16777215
  type:         Unknown []
  duration: 0 ms
  language: eng
  media:
    sample count: 0
    timescale:    65521
    duration:     12 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
  Sample Description 0
    Coding:       hvc1 (H.265)
[1]    58362 segmentation fault   --show-layout --show-samples --show-sample-data
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp42
  compatible brand: isoY
  fast start:       no

Movie:
  duration:   0 (media timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           -16777215
  type:         Unknown []
  duration: 0 ms
  language: eng
  media:
    sample count: 0
    timescale:    65521
    duration:     12 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
  Sample Description 0
    Coding:       hvc1 (H.265)
ASAN:SIGSEGV
=================================================================
==44412==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd79729f68 (pc 0x0000004a27e2 bp 0x7ffd7972a0d0 sp 0x7ffd79729f50 T0)
    #0 0x4a27e1 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:608
    #1 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #2 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #3 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #4 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #5 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #6 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #7 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #8 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    ...
    #248 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #249 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171
    #250 0x4a2908 in AP4_HevcSampleDescription::GetCodecString(AP4_String&) ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:612
    #251 0x455c1e in AP4_DvccAtom::GetCodecString(AP4_SampleDescription*, AP4_String&) ../../bento4/Source/C++/Core/Ap4DvccAtom.cpp:171

SUMMARY: AddressSanitizer: stack-overflow ../../bento4/Source/C++/Core/Ap4SampleDescription.cpp:608 AP4_HevcSampleDescription::GetCodecString(AP4_String&)
==44412==ABORTING
```

## POC
[StackOverflow-GetCodecString-Ap4SampleDescription_cpp-612.zip](https://github.com/axiomatic-systems/Bento4/files/6852609/StackOverflow-GetCodecString-Ap4SampleDescription_cpp-612.zip)


--- end body ---

A stack overflow vulnerability in the AP4_HevcSampleDescription::GetCodecString function of Bento4 allows attackers to cause a Denial of Service (DoS) by providing specially crafted input that leads to infinite recursion. This can be exploited by sending a malformed MP4 file to the mp4info command, resulting in a segmentation fault and application crash.