Fix crash in mp4 get track media data name

mp4v2-Win/include/mp4v2/project.h

@@ -6,17 +6,17 @@
 #define MP4V2_PROJECT_name            "MP4v2"
 #define MP4V2_PROJECT_name_lower      "mp4v2"
 #define MP4V2_PROJECT_name_upper      "MP4V2"
-#define MP4V2_PROJECT_name_formal     "MP4v2 4.1.5.0"
+#define MP4V2_PROJECT_name_formal     "MP4v2 4.1.6.0"
 #define MP4V2_PROJECT_url_website     "http://code.google.com/p/mp4v2"
 #define MP4V2_PROJECT_url_downloads   "http://code.google.com/p/mp4v2/downloads/list"
 #define MP4V2_PROJECT_url_discussion  "http://groups.google.com/group/mp4v2"
 #define MP4V2_PROJECT_irc             "irc://irc.freenode.net/handbrake"
 #define MP4V2_PROJECT_bugreport       "<eddyg@myreflection.org>"
-#define MP4V2_PROJECT_version         "4.1.5.0"
+#define MP4V2_PROJECT_version         "4.1.6.0"
 #define MP4V2_PROJECT_version_hex     0x00020100
 #define MP4V2_PROJECT_version_major   4
 #define MP4V2_PROJECT_version_minor   1
-#define MP4V2_PROJECT_version_point   5
+#define MP4V2_PROJECT_version_point   6
 #define MP4V2_PROJECT_repo_url        "https://mp4v2.googlecode.com/svn/trunk"
 #define MP4V2_PROJECT_repo_root       "https://mp4v2.googlecode.com/svn"
 #define MP4V2_PROJECT_repo_uuid       "6e6572fa-98a6-11dd-ad9f-f77439c74b79"

mp4v2-Win/mp4v2.autopkg

@@ -10,7 +10,7 @@ nuget
    nuspec
    {
       id = mp4v2;
-      version: 4.1.5;
+      version: 4.1.6;
       title: MP4v2 Library;
       authors: { TechSmith Corporation };
       owners: { TechSmith Corporation };
@@ -35,7 +35,8 @@ nuget
          4.1.2   Finalize changes to handle ProRes MOV files correctly
          4.1.3   ftyp atom optional for MOV files
          4.1.4   Update to VS 2019; allow parsing of some atoms to be skipped
-         4.1.5   Revert to VS 2017";
+         4.1.5   Revert to VS 2017
+         4.1.6   Fix crash with fuzzed mp4";
       copyright: "";
       tags: { native, mp4v2, mp4, vs2017 };
    };

mp4v2-Win/mp4v2.sln

@@ -12,6 +12,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		..\README = ..\README
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "runner", "runner\runner.vcxproj", "{5A3D5BCC-6781-4A0D-AB87-82C410569A23}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Win32 = Debug|Win32
@@ -28,6 +30,14 @@ Global
 		{BDB97A37-90B8-4906-BCAB-663D983E33E3}.Release|Win32.Build.0 = Release|Win32
 		{BDB97A37-90B8-4906-BCAB-663D983E33E3}.Release|x64.ActiveCfg = Release|x64
 		{BDB97A37-90B8-4906-BCAB-663D983E33E3}.Release|x64.Build.0 = Release|x64
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Debug|Win32.ActiveCfg = Debug|Win32
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Debug|Win32.Build.0 = Debug|Win32
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Debug|x64.ActiveCfg = Debug|x64
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Debug|x64.Build.0 = Debug|x64
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Release|Win32.ActiveCfg = Release|Win32
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Release|Win32.Build.0 = Release|Win32
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Release|x64.ActiveCfg = Release|x64
+		{5A3D5BCC-6781-4A0D-AB87-82C410569A23}.Release|x64.Build.0 = Release|x64
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

mp4v2-Win/runner/runner.cpp

@@ -0,0 +1,50 @@
+// runner.cpp : This file contains the 'main' function. Program execution begins and ends there.
+#include <iostream>
+#include <mp4v2/mp4v2.h>
+
+#include <vector>
+
+namespace
+{
+   bool parseAtomCallback( uint32_t fourCC )
+   {
+      static const std::vector<uint32_t> atomsToSkip = { 'udta', 'text' };
+
+      return std::find( atomsToSkip.cbegin(), atomsToSkip.cend(), fourCC ) == atomsToSkip.cend();
+   }
+
+   bool isVideoTrack( MP4FileHandle fh, MP4TrackId trackId )
+   {
+      return strcmp( ::MP4GetTrackType( fh, trackId ), MP4_VIDEO_TRACK_TYPE ) == 0;
+   }
+}
+
+std::vector<MP4TrackId> mp4TrackIdsOfAllVideoTracks( MP4FileHandle handle )
+{
+   std::vector<MP4TrackId> trackIds;
+   uint32_t numTracks = ::MP4GetNumberOfTracks( handle );
+   for ( uint32_t trackIndex = 0; trackIndex < numTracks; ++trackIndex )
+   {
+      MP4TrackId trackId = ::MP4FindTrackId( handle, (uint16_t)trackIndex );
+      if ( isVideoTrack( handle, trackId ) )
+         trackIds.push_back( trackId );
+   }
+   return trackIds;
+}
+
+int main()
+{
+   std::string path = "C:\\Users\\d.cheng.TSCCORP\\Desktop\\bugs\\2856 - Crash importing fuzzed MP4\\fuzzed.mp4";
+   MP4FileHandle fh = MP4Read( path.c_str(), parseAtomCallback );
+
+   std::vector<MP4TrackId> videoTrackIds = mp4TrackIdsOfAllVideoTracks( fh );
+   for ( MP4TrackId videoTrackId : videoTrackIds )
+   {
+      const char * pFourccStr = ::MP4GetTrackMediaDataName( fh, videoTrackId );
+      if ( pFourccStr == nullptr || strlen( pFourccStr ) != 4 )
+         return false;  // invalid fourCC, track can't be supported
+   }
+   return true;
+
+   MP4Close( fh );
+}

mp4v2-Win/runner/runner.vcxproj

@@ -0,0 +1,160 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{5a3d5bcc-6781-4a0d-ab87-82c410569a23}</ProjectGuid>
+    <RootNamespace>runner</RootNamespace>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)bin\$(Platform)\$(Configuration)\</OutDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)bin\$(Platform)\$(Configuration)\</OutDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)bin\$(Platform)\$(Configuration)\</OutDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)bin\$(Platform)\$(Configuration)\</OutDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>$(ProjectDir)..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>$(ProjectDir)..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>$(ProjectDir)..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>$(ProjectDir)..\..\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="runner.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\libmp4v2\libmp4v2.vcxproj">
+      <Project>{bdb97a37-90b8-4906-bcab-663d983e33e3}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

mp4v2-Win/runner/runner.vcxproj.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="runner.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

src/mp4file.cpp

@@ -3461,6 +3461,9 @@ const char *MP4File::GetTrackMediaDataName (MP4TrackId trackId)
     MP4Atom *pAtom =
         FindAtom(MakeTrackName(trackId,
                                "mdia.minf.stbl.stsd"));
+    if ( pAtom == nullptr )
+       return nullptr;
+
     if (pAtom->GetNumberOfChildAtoms() != 1) {
         log.errorf("%s: \"%s\": track %d has more than 1 child atoms in stsd", 
                    __FUNCTION__, GetFilename().c_str(), trackId);