heap-buffer-overflow in /Source/C++/Core/Ap4ByteStream.cpp:785

Question

heap-buffer-overflow in /Source/C++/Core/Ap4ByteStream.cpp:785

Opened this issue 3 years ago · 0 comments

SUMMARY: AddressSanitizer: heap-buffer-overflow in /Source/C++/Core/Ap4ByteStream.cpp:785

Version

$ ./mp42hls 
MP4 To HLS File Converter - Version 1.2
(Bento4 Version 1.6.0.0)
(c) 2002-2018 Axiomatic Systems, LLC

branch d02ef82

Platform

$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -r
5.13.0-40-generic

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.4 LTS
Release:	20.04
Codename:	focal

Steps to reproduce

$ mkdir build
$ cd build
$ cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address"
$ make

$ ./mp42hls poc

Asan

$ ./mp42hls poc
=================================================================
==851941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61900000099a at pc 0x7efc9af4758d bp 0x7fff2624ae30 sp 0x7fff2624a5d8
WRITE of size 4294967293 at 0x61900000099a thread T0
    #0 0x7efc9af4758c in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790
    #1 0x5605eaa861fe in AP4_MemoryByteStream::WritePartial(void const*, unsigned int, unsigned int&) /home/wulearn/Bento4/Source/C++/Core/Ap4ByteStream.cpp:785
    #2 0x5605eaa827bb in AP4_ByteStream::Write(void const*, unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4ByteStream.cpp:77
    #3 0x5605eab760d0 in AP4_CencSampleEncryption::DoWriteFields(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4CommonEncryption.cpp:3519
    #4 0x5605eab0fa30 in AP4_SencAtom::WriteFields(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4SencAtom.cpp:112
    #5 0x5605eaa6ae1d in AP4_Atom::Write(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4Atom.cpp:229
    #6 0x5605eaa6b4dd in AP4_Atom::Clone() /home/wulearn/Bento4/Source/C++/Core/Ap4Atom.cpp:316
    #7 0x5605eaafa2ba in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) /home/wulearn/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:138
    #8 0x5605eaafbb92 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) /home/wulearn/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:385
    #9 0x5605eab09fcd in AP4_AvcSampleEntry::ToSampleDescription() /home/wulearn/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:1152
    #10 0x5605eab1aabd in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:181
    #11 0x5605eab5d812 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #12 0x5605eab2e090 in AP4_Track::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4Track.cpp:447
    #13 0x5605eaa633bf in main /home/wulearn/Bento4/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp:2131
    #14 0x7efc9a9920b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #15 0x5605eaa5596d in _start (/home/wulearn/Bento4/build/mp42hls+0x32c96d)

0x61900000099a is located 0 bytes to the right of 1050-byte region [0x619000000580,0x61900000099a)
allocated by thread T0 here:
    #0 0x7efc9afbb787 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:107
    #1 0x5605eaa9e778 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:210
    #2 0x5605eaa9e3cc in AP4_DataBuffer::SetBufferSize(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:136
    #3 0x5605eaa9e21d in AP4_DataBuffer::Reserve(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:107
    #4 0x5605eaa86001 in AP4_MemoryByteStream::WritePartial(void const*, unsigned int, unsigned int&) /home/wulearn/Bento4/Source/C++/Core/Ap4ByteStream.cpp:765
    #5 0x5605eaa827bb in AP4_ByteStream::Write(void const*, unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4ByteStream.cpp:77
    #6 0x5605eaa82d9c in AP4_ByteStream::WriteUI24(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4ByteStream.cpp:160
    #7 0x5605eab75f8b in AP4_CencSampleEncryption::DoWriteFields(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4CommonEncryption.cpp:3507
    #8 0x5605eab0fa30 in AP4_SencAtom::WriteFields(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4SencAtom.cpp:112
    #9 0x5605eaa6ae1d in AP4_Atom::Write(AP4_ByteStream&) /home/wulearn/Bento4/Source/C++/Core/Ap4Atom.cpp:229
    #10 0x5605eaa6b4dd in AP4_Atom::Clone() /home/wulearn/Bento4/Source/C++/Core/Ap4Atom.cpp:316
    #11 0x5605eaafa2ba in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) /home/wulearn/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:138
    #12 0x5605eaafbb92 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) /home/wulearn/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:385
    #13 0x5605eab09fcd in AP4_AvcSampleEntry::ToSampleDescription() /home/wulearn/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:1152
    #14 0x5605eab1aabd in AP4_StsdAtom::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:181
    #15 0x5605eab5d812 in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207
    #16 0x5605eab2e090 in AP4_Track::GetSampleDescription(unsigned int) /home/wulearn/Bento4/Source/C++/Core/Ap4Track.cpp:447
    #17 0x5605eaa633bf in main /home/wulearn/Bento4/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp:2131
    #18 0x7efc9a9920b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8130: 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==851941==ABORTING

poc: poc.zip

Thanks!