A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.
Hi, there.

There is a segmentation fault caused by null pointer dereference in MP4fragment, Ap4StsdAtom.cpp:75 in the newest commit 5e7bb34a08272c49242196eba1cefab8af55f381.

The reason for this issue is that the return value of the GetSampleDescription is unchecked.
<img width="1055" alt="image" src="https://user-images.githubusercontent.com/7632714/196609587-2e88a5f1-1aac-4286-8c12-f28dd46e2f7b.png">

To reproduce, run:
~~~~
./mp4fragment poc /dev/null
~~~~

Here is the trace reported by ASAN:
~~~~
==3437252==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005fcb24 bp 0x60b000000300 sp 0x7ffec2967f00 T0)
 ==3437252==The signal is caused by a READ memory access.
 ==3437252==Hint: address points to the zero page.
     #0 0x5fcb24 in AP4_StsdAtom::AP4_StsdAtom(AP4_SampleTable*)  /benchmark/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:75:47
     #1 0x6b7b51 in AP4_SampleTable::GenerateStblAtom(AP4_ContainerAtom*&)  /benchmark/Bento4/Source/C++/Core/Ap4SampleTable.cpp:59:30
     #2 0x620f26 in AP4_TrakAtom::AP4_TrakAtom(AP4_SampleTable*, unsigned int, char const*, unsigned int, unsigned long long, unsigned long long, unsigned long long, unsigned int, unsigned long long, unsigned short, char const*, unsigned int, unsigned int, unsigned short, unsigned short, int const*)  /benchmark/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:131:28
     #3 0x61e255 in AP4_Track::AP4_Track(AP4_SampleTable*, unsigned int, unsigned int, unsigned long long, unsigned int, unsigned long long, AP4_Track const*)  /benchmark/Bento4/Source/C++/Core/Ap4Track.cpp:183:22
     #4 0x500733 in Fragment(AP4_File&, AP4_ByteStream&, AP4_Array<TrackCursor*>&, unsigned int, unsigned int, bool, bool, bool)  /benchmark/Bento4/Source/C++/Apps/Mp4Fragment/Mp4Fragment.cpp:360:39
     #5 0x500733 in main  /benchmark/Bento4/Source/C++/Apps/Mp4Fragment/Mp4Fragment.cpp:1475:5
     #6 0x7f0f643e9082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
     #7 0x41d8ad in _start ( /benchmark/Bento4/build-a/mp4fragment+0x41d8ad)
 
 AddressSanitizer can not provide additional info.
 SUMMARY: AddressSanitizer: SEGV  /benchmark/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:75:47 in AP4_StsdAtom::AP4_StsdAtom(AP4_SampleTable*)
 ==3437252==ABORTING
~~~~

[mp4fragment_npd_Ap4StsdAtom.cpp75.zip](https://github.com/axiomatic-systems/Bento4/files/9817303/mp4fragment_npd_Ap4StsdAtom.cpp75.zip)
(unzip first)
Segmentation fault caused by null pointer dereference in MP4fragment, Ap4StsdAtom.cpp:75
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : Segmentation fault caused by null pointer dereference in MP4fragment, Ap4StsdAtom.cpp:75
Issue date:

--- start body ---
Hi, there.

There is a segmentation fault caused by null pointer dereference in MP4fragment, Ap4StsdAtom.cpp:75 in the newest commit 5e7bb34a08272c49242196eba1cefab8af55f381.

The reason for this issue is that the return value of the GetSampleDescription is unchecked.
<img width="1055" alt="image" src="https://user-images.githubusercontent.com/7632714/196609587-2e88a5f1-1aac-4286-8c12-f28dd46e2f7b.png">

To reproduce, run:
~~~~
./mp4fragment poc /dev/null
~~~~

Here is the trace reported by ASAN:
~~~~
==3437252==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005fcb24 bp 0x60b000000300 sp 0x7ffec2967f00 T0)
 ==3437252==The signal is caused by a READ memory access.
 ==3437252==Hint: address points to the zero page.
     #0 0x5fcb24 in AP4_StsdAtom::AP4_StsdAtom(AP4_SampleTable*)  /benchmark/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:75:47
     #1 0x6b7b51 in AP4_SampleTable::GenerateStblAtom(AP4_ContainerAtom*&)  /benchmark/Bento4/Source/C++/Core/Ap4SampleTable.cpp:59:30
     #2 0x620f26 in AP4_TrakAtom::AP4_TrakAtom(AP4_SampleTable*, unsigned int, char const*, unsigned int, unsigned long long, unsigned long long, unsigned long long, unsigned int, unsigned long long, unsigned short, char const*, unsigned int, unsigned int, unsigned short, unsigned short, int const*)  /benchmark/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:131:28
     #3 0x61e255 in AP4_Track::AP4_Track(AP4_SampleTable*, unsigned int, unsigned int, unsigned long long, unsigned int, unsigned long long, AP4_Track const*)  /benchmark/Bento4/Source/C++/Core/Ap4Track.cpp:183:22
     #4 0x500733 in Fragment(AP4_File&, AP4_ByteStream&, AP4_Array<TrackCursor*>&, unsigned int, unsigned int, bool, bool, bool)  /benchmark/Bento4/Source/C++/Apps/Mp4Fragment/Mp4Fragment.cpp:360:39
     #5 0x500733 in main  /benchmark/Bento4/Source/C++/Apps/Mp4Fragment/Mp4Fragment.cpp:1475:5
     #6 0x7f0f643e9082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
     #7 0x41d8ad in _start ( /benchmark/Bento4/build-a/mp4fragment+0x41d8ad)
 
 AddressSanitizer can not provide additional info.
 SUMMARY: AddressSanitizer: SEGV  /benchmark/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:75:47 in AP4_StsdAtom::AP4_StsdAtom(AP4_SampleTable*)
 ==3437252==ABORTING
~~~~

[mp4fragment_npd_Ap4StsdAtom.cpp75.zip](https://github.com/axiomatic-systems/Bento4/files/9817303/mp4fragment_npd_Ap4StsdAtom.cpp75.zip)
(unzip first)
--- end body ---

A segmentation fault in the Bento4 library occurs due to a null pointer dereference in the AP4_StsdAtom constructor at line 75 of Ap4StsdAtom.cpp. The issue arises when the return value of GetSampleDescription is not checked, leading to an attempt to access memory at a null address. This vulnerability can be exploited by providing a specially crafted input to the mp4fragment application, resulting in a crash.