## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), `mp4info` (latest master `5922ba7`)

## **Command line**

`./mp4info @@ /dev/null`

## Output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 0
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
Segmentation fault
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 0
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
ASAN:SIGSEGV
=================================================================
==73638==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004c3253 bp 0x7fff388c7140 sp 0x7fff388c7110 T0)
    #0 0x4c3252 in AP4_Stz2Atom::WriteFields(AP4_ByteStream&) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:162
    #1 0x421101 in AP4_Atom::Write(AP4_ByteStream&) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Atom.cpp:229
    #2 0x42174f in AP4_Atom::Clone() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Atom.cpp:316
    #3 0x43d3af in AP4_ContainerAtom::Clone() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172
    #4 0x49fffe in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleDescription.cpp:135
    #5 0x4a1806 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleDescription.cpp:382
    #6 0x4ae9d8 in AP4_AvcSampleEntry::ToSampleDescription() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleEntry.cpp:1152
    #7 0x4bde65 in AP4_StsdAtom::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x4fb602 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x4cf2ca in AP4_Track::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Track.cpp:447
    #10 0x40a464 in ShowTrackInfo_Text ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1351
    #11 0x40af2e in ShowTrackInfo ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475
    #12 0x40b54a in ShowTracks ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586
    #13 0x40ceee in main ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868
    #14 0x7f8bdbe6383f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #15 0x401b28 in _start (../results/crashes/mp4info/mp4info-asan+0x401b28)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:162 AP4_Stz2Atom::WriteFields(AP4_ByteStream&)
==73638==ABORTING
```

## POC
[SEGV_WriteFields_Ap4Stz2Atom162.zip](https://github.com/axiomatic-systems/Bento4/files/7274338/SEGV_WriteFields_Ap4Stz2Atom162.zip)


SEGV_WriteFields_Ap4Stz2Atom162
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : SEGV_WriteFields_Ap4Stz2Atom162
Issue date:

--- start body ---
## System info

Ubuntu 16.04 xenial, gcc (Ubuntu 5.5.0-12ubuntu1), `mp4info` (latest master `5922ba7`)

## **Command line**

`./mp4info @@ /dev/null`

## Output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 0
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
Segmentation fault
```

## AddressSanitizer output

```bash
File:
  major brand:      mp42
  minor version:    12a007e
  compatible brand: mp4
  compatible brand: 
  fast start:       no

Movie:
  duration:   90000 (media timescale units)
  duration:   1000 (ms)
  time scale: 90000
  fragments:  no

Found 1 Tracks
Track 1:
  flags:        7 ENABLED IN-MOVIE IN-PREVIEW
  id:           1
  type:         Unknown [vmde]
  duration: 1000 ms
  language: eng
  media:
    sample count: 0
    timescale:    12
    duration:     12 (media timescale units)
    duration:     1000 (ms)
    bitrate (computed): 0.000 Kbps
  display width:  48.000000
  display height: 144.000000
ASAN:SIGSEGV
=================================================================
==73638==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004c3253 bp 0x7fff388c7140 sp 0x7fff388c7110 T0)
    #0 0x4c3252 in AP4_Stz2Atom::WriteFields(AP4_ByteStream&) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:162
    #1 0x421101 in AP4_Atom::Write(AP4_ByteStream&) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Atom.cpp:229
    #2 0x42174f in AP4_Atom::Clone() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Atom.cpp:316
    #3 0x43d3af in AP4_ContainerAtom::Clone() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172
    #4 0x49fffe in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleDescription.cpp:135
    #5 0x4a1806 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleDescription.cpp:382
    #6 0x4ae9d8 in AP4_AvcSampleEntry::ToSampleDescription() ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4SampleEntry.cpp:1152
    #7 0x4bde65 in AP4_StsdAtom::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x4fb602 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x4cf2ca in AP4_Track::GetSampleDescription(unsigned int) ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Track.cpp:447
    #10 0x40a464 in ShowTrackInfo_Text ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1351
    #11 0x40af2e in ShowTrackInfo ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475
    #12 0x40b54a in ShowTracks ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586
    #13 0x40ceee in main ../programs/programs-build-asan/bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868
    #14 0x7f8bdbe6383f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #15 0x401b28 in _start (../results/crashes/mp4info/mp4info-asan+0x401b28)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../programs/programs-build-asan/bento4/Source/C++/Core/Ap4Stz2Atom.cpp:162 AP4_Stz2Atom::WriteFields(AP4_ByteStream&)
==73638==ABORTING
```

## POC
[SEGV_WriteFields_Ap4Stz2Atom162.zip](https://github.com/axiomatic-systems/Bento4/files/7274338/SEGV_WriteFields_Ap4Stz2Atom162.zip)


--- end body ---

A segmentation fault (SIGSEGV) in the AP4_Stz2Atom::WriteFields function of Bento4 allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input file. This vulnerability can lead to application crashes when processing certain MP4 files, indicating a potential security risk.