New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap-buffer-overflow in Ap4AvccAtom.cpp:88 at Bento4 1.5.1-627 when running mp42hls #345

Closed
PikaQQQ opened this Issue Dec 21, 2018 · 1 comment

Comments

Projects
None yet
2 participants
@PikaQQQ
Copy link

PikaQQQ commented Dec 21, 2018

A crafted input will lead to heap buffer overflow failed in Ap4AvccAtom.cpp at Bento4 1.5.1-627

Triggered by
./mp42hls crash4.mp4

Poc
crash4.mp4.zip

Bento4 Version 1.5.1-627
The ASAN information is as follows:

=================================================================
==24829==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000bc at pc 0x559f29a7d8b2 bp 0x7ffcd79471e0 sp 0x7ffcd79471d0
READ of size 1 at 0x6040000000bc thread T0
    #0 0x559f29a7d8b1 in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AvccAtom.cpp:88
    #1 0x559f29a7a0c4 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:479
    #2 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #3 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #4 0x559f29af6494 in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:115
    #5 0x559f29afa710 in AP4_VisualSampleEntry::AP4_VisualSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:742
    #6 0x559f29afbf00 in AP4_AvcSampleEntry::AP4_AvcSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:994
    #7 0x559f29a78e2d in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:306
    #8 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #9 0x559f29b0cce5 in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4StsdAtom.cpp:101
    #10 0x559f29b0c553 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4StsdAtom.cpp:57
    #11 0x559f29a79ca4 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:424
    #12 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #13 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #14 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #15 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #16 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #17 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #18 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #19 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #20 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #21 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #22 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #23 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #24 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #25 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #26 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #27 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #28 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #29 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #30 0x559f29b23530 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4TrakAtom.cpp:165
    #31 0x559f29a7c589 in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) (/home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/cmakebuild/mp42hls+0x348589)
    #32 0x559f29a7993d in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:379
    #33 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #34 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #35 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #36 0x559f29abbd52 in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4MoovAtom.cpp:80
    #37 0x559f29a7c523 in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) (/home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/cmakebuild/mp42hls+0x348523)
    #38 0x559f29a797b6 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:359
    #39 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #40 0x559f29a778d3 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:151
    #41 0x559f29a98849 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4File.cpp:104
    #42 0x559f29a984b8 in AP4_File::AP4_File(AP4_ByteStream&, bool) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4File.cpp:78
    #43 0x559f29a64ec3 in main /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp:1837
    #44 0x7fefa23abb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #45 0x559f29a58a89 in _start (/home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/cmakebuild/mp42hls+0x324a89)

0x6040000000bc is located 0 bytes to the right of 44-byte region [0x604000000090,0x6040000000bc)
allocated by thread T0 here:
    #0 0x7fefa2dfc618 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0618)
    #1 0x559f29a905f9 in AP4_DataBuffer::AP4_DataBuffer(unsigned int) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4DataBuffer.cpp:55
    #2 0x559f29a7d6a1 in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AvccAtom.cpp:69
    #3 0x559f29a7a0c4 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:479
    #4 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #5 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #6 0x559f29af6494 in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:115
    #7 0x559f29afa710 in AP4_VisualSampleEntry::AP4_VisualSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:742
    #8 0x559f29afbf00 in AP4_AvcSampleEntry::AP4_AvcSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4SampleEntry.cpp:994
    #9 0x559f29a78e2d in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:306
    #10 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #11 0x559f29b0cce5 in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4StsdAtom.cpp:101
    #12 0x559f29b0c553 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4StsdAtom.cpp:57
    #13 0x559f29a79ca4 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:424
    #14 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #15 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #16 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #17 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #18 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #19 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #20 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #21 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #22 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #23 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #24 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221
    #25 0x559f29a895bc in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #26 0x559f29a89030 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #27 0x559f29a88b8e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #28 0x559f29a7b519 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:764
    #29 0x559f29a78310 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AtomFactory.cpp:221

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/parallels/Desktop/Fuzz/Bento4/Bento4-SRC-1-5-1-627/Source/C++/Core/Ap4AvccAtom.cpp:88 in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&)
Shadow bytes around the buggy address:
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=>0x0c087fff8010: fa fa 00 00 00 00 00[04]fa fa fa fa fa fa fa fa
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==24829==ABORTING

FoundBy: yjiiit@aliyun.com

@fgeek

This comment has been minimized.

Copy link

fgeek commented Jan 1, 2019

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20409 has been assigned for this vulnerability. Here is minimized sample CVE-2018-20409.zip.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment