A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.
A memory allocation failure unhandled in Ap4RtpAtom.cpp and leads to crashes. This seems to be an incomplete fix of issue #396, CVE-2019-13238.

`./mp42aac input_file /dev/null`

In file Source/C++/Core/Ap4RtpAtom.cpp
<img width="929" alt="image" src="https://user-images.githubusercontent.com/7632714/196694985-02cb68d8-62b7-44e4-ac8a-01137ddd038e.png">
AP4_RtpAtom allocate a new buffer to parse the atom in the stream. 
The unhandled memory allocation failure cause the read content memcpy to a null pointer.

The rest of issue seems be similar with previous issue.

Asan trace report:

~~~~
==725001==WARNING: AddressSanitizer failed to allocate 0xffffffffff00025b bytes
=================================================================
==725001==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0xffffffffff00025b bytes
    #0 0x4f7fb7 in operator new[](unsigned long)  /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102:3
    #1 0x652e4a in AP4_RtpAtom::AP4_RtpAtom(unsigned int, AP4_ByteStream&)  /benchmark/Bento4/Source/C++/Core/Ap4RtpAtom.cpp:50:25

==725001==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory  /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102:3 in operator new[](unsigned long)
==725001==ABORTING
~~~~

[mp42aac_exhaustive_AP4_RtpAtom50.zip](https://github.com/axiomatic-systems/Bento4/files/9820612/mp42aac_exhaustive_AP4_RtpAtom50.zip)
(unzip first)


Incomplete fix of CVE-2019-13238, Exhaustive memory misunhandle
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : Incomplete fix of CVE-2019-13238, Exhaustive memory misunhandle
Issue date:

--- start body ---
A memory allocation failure unhandled in Ap4RtpAtom.cpp and leads to crashes. This seems to be an incomplete fix of issue #396, CVE-2019-13238.

`./mp42aac input_file /dev/null`

In file Source/C++/Core/Ap4RtpAtom.cpp
<img width="929" alt="image" src="https://user-images.githubusercontent.com/7632714/196694985-02cb68d8-62b7-44e4-ac8a-01137ddd038e.png">
AP4_RtpAtom allocate a new buffer to parse the atom in the stream. 
The unhandled memory allocation failure cause the read content memcpy to a null pointer.

The rest of issue seems be similar with previous issue.

Asan trace report:

~~~~
==725001==WARNING: AddressSanitizer failed to allocate 0xffffffffff00025b bytes
=================================================================
==725001==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0xffffffffff00025b bytes
    #0 0x4f7fb7 in operator new[](unsigned long)  /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102:3
    #1 0x652e4a in AP4_RtpAtom::AP4_RtpAtom(unsigned int, AP4_ByteStream&)  /benchmark/Bento4/Source/C++/Core/Ap4RtpAtom.cpp:50:25

==725001==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory  /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102:3 in operator new[](unsigned long)
==725001==ABORTING
~~~~

[mp42aac_exhaustive_AP4_RtpAtom50.zip](https://github.com/axiomatic-systems/Bento4/files/9820612/mp42aac_exhaustive_AP4_RtpAtom50.zip)
(unzip first)


--- end body ---

A memory allocation failure in the AP4_RtpAtom constructor of Bento4 can lead to a crash due to unhandled memory allocation errors. This issue appears to be an incomplete fix for CVE-2019-13238, where the program does not properly handle the case when memory allocation fails, resulting in a null pointer dereference during a memcpy operation.