SUMMARY: AddressSanitizer: heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196

- Version

```
$ ./mp4info
MP4 File Info - Version 1.3.4
(Bento4 Version 1.6.0.0)
(c) 2002-2017 Axiomatic Systems, LLC
```

branch [ab5591e](https://github.com/axiomatic-systems/Bento4/commit/ab5591eced36fa034b5203692cdd4b4730d46e31)

- Platform

```
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -r
5.15.0-57-generic

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.5 LTS
Release:	20.04
Codename:	focal
```

- Steps to reproduce

```
$ mkdir build_asan
$ cd build_asan
$ cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address"
$ make
$ ./mp4info --show-samples poc
```

- Asan

```
$ ./mp4info --show-samples poc

Movie:
  duration:   0 (movie timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  yes

Found 1 Tracks
Track 1:
  flags:        3158064
  id:           1
  type:         Unknown []
  duration: 0 ms
  language: (null)
  media:
    sample count: 0
    timescale:    0
    duration:     0 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
    sample count with fragments: 1
    duration with fragments:     0
    duration with fragments:     0 (ms)
  display width:  12336.188477
  display height: 12336.188477
  Sample Description 0
    Coding:       avc1 (H.264)
    Codec String: avc1.303030
    AVC Profile:          48
    AVC Profile Compat:   30
    AVC Level:            48
    AVC NALU Length Size: 1
    AVC SPS: []
    AVC PPS: []
    Width:       12336
    Height:      12336
    Depth:       12336
Track 1:
=================================================================
==3661750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000002f1 at pc 0x561368557323 bp 0x7ffd84a9d4e0 sp 0x7ffd84a9d4d0
READ of size 1 at 0x6020000002f1 thread T0
    #0 0x561368557322 in ShowAvcInfo /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
    #1 0x561368557747 in ShowSample_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1263
    #2 0x56136855ae0a in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1822
    #3 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #4 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308
    #5 0x56136854e8ad in _start (/home/cl3nn0/Downloads/test/Bento4/build_asan/mp4info+0x3268ad)

0x6020000002f1 is located 0 bytes to the right of 1-byte region [0x6020000002f0,0x6020000002f1)
allocated by thread T0 here:
    #0 0x7f088f765787 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:107
    #1 0x5613685a4a6e in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:210
    #2 0x5613685a4875 in AP4_DataBuffer::SetData(unsigned char const*, unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:169
    #3 0x5613685be9c5 in AP4_LinearReader::PopSample(AP4_LinearReader::Tracker*, AP4_Sample&, AP4_DataBuffer*) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:497
    #4 0x5613685bee3e in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer*, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:570
    #5 0x5613685bef19 in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer&, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:591
    #6 0x56136855ab3e in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1797
    #7 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #8 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196 in ShowAvcInfo
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
  0x0c047fff8010: fa fa 00 04 fa fa 00 fa fa fa fd fd fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 01 fa
  0x0c047fff8040: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
=>0x0c047fff8050: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa[01]fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3661750==ABORTING
```

poc :  [poc.zip](https://github.com/axiomatic-systems/Bento4/files/10964165/poc.zip)

Thanks!
heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
Issue date:

--- start body ---
SUMMARY: AddressSanitizer: heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196

- Version

```
$ ./mp4info
MP4 File Info - Version 1.3.4
(Bento4 Version 1.6.0.0)
(c) 2002-2017 Axiomatic Systems, LLC
```

branch [ab5591e](https://github.com/axiomatic-systems/Bento4/commit/ab5591eced36fa034b5203692cdd4b4730d46e31)

- Platform

```
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -r
5.15.0-57-generic

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.5 LTS
Release:	20.04
Codename:	focal
```

- Steps to reproduce

```
$ mkdir build_asan
$ cd build_asan
$ cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address"
$ make
$ ./mp4info --show-samples poc
```

- Asan

```
$ ./mp4info --show-samples poc

Movie:
  duration:   0 (movie timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  yes

Found 1 Tracks
Track 1:
  flags:        3158064
  id:           1
  type:         Unknown []
  duration: 0 ms
  language: (null)
  media:
    sample count: 0
    timescale:    0
    duration:     0 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
    sample count with fragments: 1
    duration with fragments:     0
    duration with fragments:     0 (ms)
  display width:  12336.188477
  display height: 12336.188477
  Sample Description 0
    Coding:       avc1 (H.264)
    Codec String: avc1.303030
    AVC Profile:          48
    AVC Profile Compat:   30
    AVC Level:            48
    AVC NALU Length Size: 1
    AVC SPS: []
    AVC PPS: []
    Width:       12336
    Height:      12336
    Depth:       12336
Track 1:
=================================================================
==3661750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000002f1 at pc 0x561368557323 bp 0x7ffd84a9d4e0 sp 0x7ffd84a9d4d0
READ of size 1 at 0x6020000002f1 thread T0
    #0 0x561368557322 in ShowAvcInfo /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
    #1 0x561368557747 in ShowSample_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1263
    #2 0x56136855ae0a in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1822
    #3 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #4 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308
    #5 0x56136854e8ad in _start (/home/cl3nn0/Downloads/test/Bento4/build_asan/mp4info+0x3268ad)

0x6020000002f1 is located 0 bytes to the right of 1-byte region [0x6020000002f0,0x6020000002f1)
allocated by thread T0 here:
    #0 0x7f088f765787 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:107
    #1 0x5613685a4a6e in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:210
    #2 0x5613685a4875 in AP4_DataBuffer::SetData(unsigned char const*, unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:169
    #3 0x5613685be9c5 in AP4_LinearReader::PopSample(AP4_LinearReader::Tracker*, AP4_Sample&, AP4_DataBuffer*) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:497
    #4 0x5613685bee3e in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer*, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:570
    #5 0x5613685bef19 in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer&, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:591
    #6 0x56136855ab3e in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1797
    #7 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #8 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196 in ShowAvcInfo
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
  0x0c047fff8010: fa fa 00 04 fa fa 00 fa fa fa fd fd fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 01 fa
  0x0c047fff8040: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
=>0x0c047fff8050: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa[01]fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3661750==ABORTING
```

poc :  [poc.zip](https://github.com/axiomatic-systems/Bento4/files/10964165/poc.zip)

Thanks!
--- end body ---

A heap-buffer-overflow vulnerability in the Mp4Info application of Bento4 version 1.6.0.0 allows attackers to exploit memory corruption issues, potentially leading to arbitrary code execution or denial of service. The issue occurs when processing specially crafted MP4 files, as indicated by the AddressSanitizer output.