An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor::GetTag in mp42ts when called from AP4_DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor in Ap4DecoderConfigDescriptor.cpp.
./mp42ts $poc out
poc
[poc1.zip](https://github.com/axiomatic-systems/Bento4/files/3938679/poc1.zip)
[poc2.zip](https://github.com/axiomatic-systems/Bento4/files/3938680/poc2.zip)
asan output
1
```
root@ubuntu:/home/tim/Bento4/cmakebuild# ../../Bento4-asan/cmakebuild/mp42ts crashes/test-001.mp4-signalb-0x0 out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4527==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5641267801c3 bp 0x7ffe30da6fb0 sp 0x7ffe30da6fa0 T0)
==4527==The signal is caused by a READ memory access.
==4527==Hint: address points to the zero page.
    #0 0x5641267801c2 in AP4_Descriptor::GetTag() (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2)
    #1 0x5641267802af in AP4_DescriptorFinder::Test(AP4_Descriptor*) const (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3972af)
    #2 0x564126780d9c in AP4_List<AP4_Descriptor>::Find(AP4_List<AP4_Descriptor>::Item::Finder const&, AP4_Descriptor*&) const /home/tim/Bento4-asan/Source/C++/Core/Ap4List.h:431
    #3 0x56412677fe05 in AP4_DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor() const /home/tim/Bento4-asan/Source/C++/Core/Ap4DecoderConfigDescriptor.cpp:159
    #4 0x564126735776 in AP4_MpegSampleDescription::AP4_MpegSampleDescription(unsigned int, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:591
    #5 0x564126735f95 in AP4_MpegAudioSampleDescription::AP4_MpegAudioSampleDescription(unsigned int, unsigned short, unsigned short, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:697
    #6 0x56412673c990 in AP4_MpegAudioSampleEntry::ToSampleDescription() /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleEntry.cpp:678
    #7 0x5641267ddc0f in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x56412676f4e0 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x564126745914 in AP4_Track::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4Track.cpp:445
    #10 0x5641267113a0 in main /home/tim/Bento4-asan/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:563
    #11 0x7fd96c6d3b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
    #12 0x56412670e459 in _start (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x325459)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2) in AP4_Descriptor::GetTag()
==4527==ABORTING

```
2
```
root@ubuntu:/home/tim/Bento4/cmakebuild# ../../Bento4-asan/cmakebuild/mp42ts crashes/test-001.mp4-signalb-0x4 out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4528==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x560f0b6bc1c3 bp 0x7ffc50b88480 sp 0x7ffc50b88470 T0)
==4528==The signal is caused by a READ memory access.
==4528==Hint: address points to the zero page.
    #0 0x560f0b6bc1c2 in AP4_Descriptor::GetTag() (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2)
    #1 0x560f0b6bc2af in AP4_DescriptorFinder::Test(AP4_Descriptor*) const (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3972af)
    #2 0x560f0b6bcd9c in AP4_List<AP4_Descriptor>::Find(AP4_List<AP4_Descriptor>::Item::Finder const&, AP4_Descriptor*&) const /home/tim/Bento4-asan/Source/C++/Core/Ap4List.h:431
    #3 0x560f0b6c3f1f in AP4_EsDescriptor::GetDecoderConfigDescriptor() const /home/tim/Bento4-asan/Source/C++/Core/Ap4EsDescriptor.cpp:207
    #4 0x560f0b671417 in AP4_MpegSampleDescription::AP4_MpegSampleDescription(unsigned int, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:583
    #5 0x560f0b671f95 in AP4_MpegAudioSampleDescription::AP4_MpegAudioSampleDescription(unsigned int, unsigned short, unsigned short, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:697
    #6 0x560f0b678990 in AP4_MpegAudioSampleEntry::ToSampleDescription() /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleEntry.cpp:678
    #7 0x560f0b719c0f in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x560f0b6ab4e0 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x560f0b681914 in AP4_Track::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4Track.cpp:445
    #10 0x560f0b64d3a0 in main /home/tim/Bento4-asan/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:563
    #11 0x7f5eaef1fb6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
    #12 0x560f0b64a459 in _start (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x325459)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2) in AP4_Descriptor::GetTag()
==4528==ABORTING

```

2 segv in mp42ts
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : 2 segv in mp42ts
Issue date:

--- start body ---
./mp42ts $poc out
poc
[poc1.zip](https://github.com/axiomatic-systems/Bento4/files/3938679/poc1.zip)
[poc2.zip](https://github.com/axiomatic-systems/Bento4/files/3938680/poc2.zip)
asan output
1
```
root@ubuntu:/home/tim/Bento4/cmakebuild# ../../Bento4-asan/cmakebuild/mp42ts crashes/test-001.mp4-signalb-0x0 out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4527==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5641267801c3 bp 0x7ffe30da6fb0 sp 0x7ffe30da6fa0 T0)
==4527==The signal is caused by a READ memory access.
==4527==Hint: address points to the zero page.
    #0 0x5641267801c2 in AP4_Descriptor::GetTag() (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2)
    #1 0x5641267802af in AP4_DescriptorFinder::Test(AP4_Descriptor*) const (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3972af)
    #2 0x564126780d9c in AP4_List<AP4_Descriptor>::Find(AP4_List<AP4_Descriptor>::Item::Finder const&, AP4_Descriptor*&) const /home/tim/Bento4-asan/Source/C++/Core/Ap4List.h:431
    #3 0x56412677fe05 in AP4_DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor() const /home/tim/Bento4-asan/Source/C++/Core/Ap4DecoderConfigDescriptor.cpp:159
    #4 0x564126735776 in AP4_MpegSampleDescription::AP4_MpegSampleDescription(unsigned int, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:591
    #5 0x564126735f95 in AP4_MpegAudioSampleDescription::AP4_MpegAudioSampleDescription(unsigned int, unsigned short, unsigned short, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:697
    #6 0x56412673c990 in AP4_MpegAudioSampleEntry::ToSampleDescription() /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleEntry.cpp:678
    #7 0x5641267ddc0f in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x56412676f4e0 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x564126745914 in AP4_Track::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4Track.cpp:445
    #10 0x5641267113a0 in main /home/tim/Bento4-asan/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:563
    #11 0x7fd96c6d3b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
    #12 0x56412670e459 in _start (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x325459)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2) in AP4_Descriptor::GetTag()
==4527==ABORTING

```
2
```
root@ubuntu:/home/tim/Bento4/cmakebuild# ../../Bento4-asan/cmakebuild/mp42ts crashes/test-001.mp4-signalb-0x4 out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4528==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x560f0b6bc1c3 bp 0x7ffc50b88480 sp 0x7ffc50b88470 T0)
==4528==The signal is caused by a READ memory access.
==4528==Hint: address points to the zero page.
    #0 0x560f0b6bc1c2 in AP4_Descriptor::GetTag() (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2)
    #1 0x560f0b6bc2af in AP4_DescriptorFinder::Test(AP4_Descriptor*) const (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3972af)
    #2 0x560f0b6bcd9c in AP4_List<AP4_Descriptor>::Find(AP4_List<AP4_Descriptor>::Item::Finder const&, AP4_Descriptor*&) const /home/tim/Bento4-asan/Source/C++/Core/Ap4List.h:431
    #3 0x560f0b6c3f1f in AP4_EsDescriptor::GetDecoderConfigDescriptor() const /home/tim/Bento4-asan/Source/C++/Core/Ap4EsDescriptor.cpp:207
    #4 0x560f0b671417 in AP4_MpegSampleDescription::AP4_MpegSampleDescription(unsigned int, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:583
    #5 0x560f0b671f95 in AP4_MpegAudioSampleDescription::AP4_MpegAudioSampleDescription(unsigned int, unsigned short, unsigned short, AP4_EsdsAtom*) /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleDescription.cpp:697
    #6 0x560f0b678990 in AP4_MpegAudioSampleEntry::ToSampleDescription() /home/tim/Bento4-asan/Source/C++/Core/Ap4SampleEntry.cpp:678
    #7 0x560f0b719c0f in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4StsdAtom.cpp:181
    #8 0x560f0b6ab4e0 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #9 0x560f0b681914 in AP4_Track::GetSampleDescription(unsigned int) /home/tim/Bento4-asan/Source/C++/Core/Ap4Track.cpp:445
    #10 0x560f0b64d3a0 in main /home/tim/Bento4-asan/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:563
    #11 0x7f5eaef1fb6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
    #12 0x560f0b64a459 in _start (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x325459)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/tim/Bento4-asan/cmakebuild/mp42ts+0x3971c2) in AP4_Descriptor::GetTag()
==4528==ABORTING

```

--- end body ---

The issue in the mp42ts component of Bento4 indicates a segmentation fault (SEGV) caused by a null pointer dereference when processing certain MP4 files. This vulnerability can lead to a Denial of Service (DoS) as the application crashes upon attempting to read memory at an invalid address. The AddressSanitizer output shows that the crash occurs in the AP4_Descriptor::GetTag() function, which suggests that the application does not properly handle invalid or corrupted input files, allowing for potential exploitation.