{"id":2221,"date":"2017-09-14T12:37:21","date_gmt":"2017-09-14T10:37:21","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=2221"},"modified":"2017-09-22T09:10:06","modified_gmt":"2017-09-22T07:10:06","slug":"bento4-null-pointer-dereference-in-ap4_dataatomap4_dataatom-ap4metadata-cpp","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/09\/14\/bento4-null-pointer-dereference-in-ap4_dataatomap4_dataatom-ap4metadata-cpp\/","title":{"rendered":"bento4: NULL pointer dereference in AP4_DataAtom::~AP4_DataAtom (Ap4MetaData.cpp)"},"content":{"rendered":"

Description<\/strong>:
\nbento4<\/a> is a fast, modern, open source C++ toolkit for all your MP4 and MPEG DASH media format needs.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# mp42aac $FILE out.aac\r\nASAN:DEADLYSIGNAL\r\n=================================================================\r\n==11595==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005b27fe bp 0x7ffce60a67e0 sp 0x7ffce60a67c0 T0)\r\n==11595==The signal is caused by a READ memory access.\r\n==11595==Hint: address points to the zero page.\r\n    #0 0x5b27fd in AP4_DataAtom::~AP4_DataAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/MetaData\/Ap4MetaData.cpp:1357:5\r\n    #1 0x5b27fd in AP4_DataAtom::~AP4_DataAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/MetaData\/Ap4MetaData.cpp:1356\r\n    #2 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #3 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #4 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48:7\r\n    #5 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48\r\n    #6 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #7 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #8 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48:7\r\n    #9 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48\r\n    #10 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #11 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #12 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48:7\r\n    #13 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48\r\n    #14 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #15 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #16 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48:7\r\n    #17 0x60e6d8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48\r\n    #18 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #19 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #20 0x553af8 in AP4_ContainerAtom::~AP4_ContainerAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4ContainerAtom.h:48:7\r\n    #21 0x553af8 in AP4_MoovAtom::~AP4_MoovAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4MoovAtom.h:47\r\n    #22 0x553af8 in AP4_MoovAtom::~AP4_MoovAtom() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4MoovAtom.h:47\r\n    #23 0x5bf8d4 in AP4_List::DeleteReferences() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4List.h:476:9\r\n    #24 0x5bf8d4 in AP4_AtomParent::~AP4_AtomParent() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4Atom.cpp:512\r\n    #25 0x54f634 in AP4_File::~AP4_File() \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Core\/Ap4File.cpp:85:1\r\n    #26 0x5433c4 in main \/tmp\/Bento4-1.5.0-617\/Source\/C++\/Apps\/Mp42Aac\/Mp42Aac.cpp:292:5\r\n    #27 0x7f0ba50e1680 in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #28 0x44f3f8 in _start (\/usr\/bin\/mp42aac+0x44f3f8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/Bento4-1.5.0-617\/Source\/C++\/MetaData\/Ap4MetaData.cpp:1357:5 in AP4_DataAtom::~AP4_DataAtom()\r\n==11595==ABORTING\r\nAudio Track:\r\n  duration: 7848 ms\r\n  sample count: 16\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.5.0-617<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/github.com\/axiomatic-systems\/Bento4\/commit\/41cad602709436628f07b4c4f64e9ff7a611f687<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-14641<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00338-bento4-NULLptr-AP4_DataAtom_AP4_DataAtom<\/a><\/p>\n
Timeline:<\/strong>
\n2017-09-08: bug discovered and reported to upstream
\n2017-09-14: blog post about the issue
\n2017-09-21: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
bento4: NULL pointer dereference in AP4_DataAtom::~AP4_DataAtom (Ap4MetaData.cpp)<\/a><\/p><\/blockquote>\n