Pikaqqq

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.5.1-627 Description: An issue was discovered in the AP4 StcoAtom class, which is located in Core/Ap4StcoAtom.cpp. This issue occurs when the AP4 AtomFactory::CreateAtomFromStream function in Core/Ap4AtomFactory.cpp calls the AP4 StcoAtom class, resulting in an attempted excessive memory allocation. This has been demonstrated using the mp42hls tool. Recommendations: For Bento4 version 1.5.1-627, consider restricting the use of the AP4 StcoAtom class until a patch is available. As a temporary workaround, avoid using the AP4 AtomFactory::CreateAtomFromStream function in Core/Ap4AtomFactory.cpp to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

An issue was discovered in the AP4 DataBuffer class when called from AP4 HvccAtom::Create in Core/Ap4HvccAtom.cpp, where there is an attempt at excessive memory allocation.

A heap-based buffer over-read issue was discovered in the AP4 AvccAtom::Create function in Core/Ap4AvccAtom.cpp. This issue is demonstrated by the mp42hls tool.

A memory leak issue was found in the AP4 StdcFileByteStream::Create function, located in System/StdC/Ap4StdCFileByteStream.cpp. This issue is demonstrated by the mp42hls tool.

A memory leak issue was found in the `AP4 DescriptorFactory::CreateDescriptorFromStream` function, located in `Core/Ap4DescriptorFactory.cpp`. This issue is demonstrated by the `mp42hls` tool.

An issue was discovered that allows attackers to trigger an attempted excessive memory allocation. This is related to the `AP4 DataBuffer::SetDataSize` and `AP4 DataBuffer::ReallocateBuffer` functions in Core/Ap4DataBuffer.cpp, which are used by the `AP4 Sample::ReadData` function in Core/Ap4Sample.cpp.

An issue was discovered in the EnsureCapacity function in Core/Ap4Array.h. It allows crafted MP4 input to trigger an attempt at excessive memory allocation.