SUMMARY: AddressSanitizer: heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196

- Version

```
$ ./mp4info
MP4 File Info - Version 1.3.4
(Bento4 Version 1.6.0.0)
(c) 2002-2017 Axiomatic Systems, LLC
```

branch [ab5591e](https://github.com/axiomatic-systems/Bento4/commit/ab5591eced36fa034b5203692cdd4b4730d46e31)

- Platform

```
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -r
5.15.0-57-generic

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.5 LTS
Release:	20.04
Codename:	focal
```

- Steps to reproduce

```
$ mkdir build_asan
$ cd build_asan
$ cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address"
$ make
$ ./mp4info --show-samples poc
```

- Asan

```
$ ./mp4info --show-samples poc

Movie:
  duration:   0 (movie timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  yes

Found 1 Tracks
Track 1:
  flags:        3158064
  id:           1
  type:         Unknown []
  duration: 0 ms
  language: (null)
  media:
    sample count: 0
    timescale:    0
    duration:     0 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
    sample count with fragments: 1
    duration with fragments:     0
    duration with fragments:     0 (ms)
  display width:  12336.188477
  display height: 12336.188477
  Sample Description 0
    Coding:       avc1 (H.264)
    Codec String: avc1.303030
    AVC Profile:          48
    AVC Profile Compat:   30
    AVC Level:            48
    AVC NALU Length Size: 1
    AVC SPS: []
    AVC PPS: []
    Width:       12336
    Height:      12336
    Depth:       12336
Track 1:
=================================================================
==3661750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000002f1 at pc 0x561368557323 bp 0x7ffd84a9d4e0 sp 0x7ffd84a9d4d0
READ of size 1 at 0x6020000002f1 thread T0
    #0 0x561368557322 in ShowAvcInfo /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
    #1 0x561368557747 in ShowSample_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1263
    #2 0x56136855ae0a in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1822
    #3 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #4 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308
    #5 0x56136854e8ad in _start (/home/cl3nn0/Downloads/test/Bento4/build_asan/mp4info+0x3268ad)

0x6020000002f1 is located 0 bytes to the right of 1-byte region [0x6020000002f0,0x6020000002f1)
allocated by thread T0 here:
    #0 0x7f088f765787 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:107
    #1 0x5613685a4a6e in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:210
    #2 0x5613685a4875 in AP4_DataBuffer::SetData(unsigned char const*, unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:169
    #3 0x5613685be9c5 in AP4_LinearReader::PopSample(AP4_LinearReader::Tracker*, AP4_Sample&, AP4_DataBuffer*) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:497
    #4 0x5613685bee3e in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer*, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:570
    #5 0x5613685bef19 in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer&, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:591
    #6 0x56136855ab3e in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1797
    #7 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #8 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196 in ShowAvcInfo
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
  0x0c047fff8010: fa fa 00 04 fa fa 00 fa fa fa fd fd fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 01 fa
  0x0c047fff8040: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
=>0x0c047fff8050: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa[01]fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3661750==ABORTING
```

poc :  [poc.zip](https://github.com/axiomatic-systems/Bento4/files/10964165/poc.zip)

Thanks!
heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
Issue date:

--- start body ---
SUMMARY: AddressSanitizer: heap-buffer-overflow in /Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196

- Version

```
$ ./mp4info
MP4 File Info - Version 1.3.4
(Bento4 Version 1.6.0.0)
(c) 2002-2017 Axiomatic Systems, LLC
```

branch [ab5591e](https://github.com/axiomatic-systems/Bento4/commit/ab5591eced36fa034b5203692cdd4b4730d46e31)

- Platform

```
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -r
5.15.0-57-generic

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.5 LTS
Release:	20.04
Codename:	focal
```

- Steps to reproduce

```
$ mkdir build_asan
$ cd build_asan
$ cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address"
$ make
$ ./mp4info --show-samples poc
```

- Asan

```
$ ./mp4info --show-samples poc

Movie:
  duration:   0 (movie timescale units)
  duration:   0 (ms)
  time scale: 0
  fragments:  yes

Found 1 Tracks
Track 1:
  flags:        3158064
  id:           1
  type:         Unknown []
  duration: 0 ms
  language: (null)
  media:
    sample count: 0
    timescale:    0
    duration:     0 (media timescale units)
    duration:     0 (ms)
    bitrate (computed): 0.000 Kbps
    sample count with fragments: 1
    duration with fragments:     0
    duration with fragments:     0 (ms)
  display width:  12336.188477
  display height: 12336.188477
  Sample Description 0
    Coding:       avc1 (H.264)
    Codec String: avc1.303030
    AVC Profile:          48
    AVC Profile Compat:   30
    AVC Level:            48
    AVC NALU Length Size: 1
    AVC SPS: []
    AVC PPS: []
    Width:       12336
    Height:      12336
    Depth:       12336
Track 1:
=================================================================
==3661750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000002f1 at pc 0x561368557323 bp 0x7ffd84a9d4e0 sp 0x7ffd84a9d4d0
READ of size 1 at 0x6020000002f1 thread T0
    #0 0x561368557322 in ShowAvcInfo /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196
    #1 0x561368557747 in ShowSample_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1263
    #2 0x56136855ae0a in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1822
    #3 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #4 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308
    #5 0x56136854e8ad in _start (/home/cl3nn0/Downloads/test/Bento4/build_asan/mp4info+0x3268ad)

0x6020000002f1 is located 0 bytes to the right of 1-byte region [0x6020000002f0,0x6020000002f1)
allocated by thread T0 here:
    #0 0x7f088f765787 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:107
    #1 0x5613685a4a6e in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:210
    #2 0x5613685a4875 in AP4_DataBuffer::SetData(unsigned char const*, unsigned int) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:169
    #3 0x5613685be9c5 in AP4_LinearReader::PopSample(AP4_LinearReader::Tracker*, AP4_Sample&, AP4_DataBuffer*) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:497
    #4 0x5613685bee3e in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer*, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:570
    #5 0x5613685bef19 in AP4_LinearReader::ReadNextSample(AP4_Sample&, AP4_DataBuffer&, unsigned int&) /home/cl3nn0/Downloads/test/Bento4/Source/C++/Core/Ap4LinearReader.cpp:591
    #6 0x56136855ab3e in ShowFragments_Text /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1797
    #7 0x56136855b786 in main /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1927
    #8 0x7f088f13c082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/cl3nn0/Downloads/test/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1196 in ShowAvcInfo
Shadow bytes around the buggy address:
  0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
  0x0c047fff8010: fa fa 00 04 fa fa 00 fa fa fa fd fd fa fa fd fd
  0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 01 fa
  0x0c047fff8040: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
=>0x0c047fff8050: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa[01]fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3661750==ABORTING
```

poc :  [poc.zip](https://github.com/axiomatic-systems/Bento4/files/10964165/poc.zip)

Thanks!
--- end body ---
