# Summary
Hi, developers of Bento4:
I tested the binary mp42hevc with my fuzzer, and a crash incurred—SEGV on unknown address in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool). The following is the details.


# Bug
Detected SEGV on unknown address in AP4_File::ParseStream.
```
root@2e47aa8b3277:/# ./Bento4/cmakebuild/mp42hevc POC_mp42hevc_1 /dev/null
ERROR: cannot open input (-4)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2297862==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005029ca bp 0x7ffda4602cd0 sp 0x7ffda4602ba0 T0)
==2297862==The signal is caused by a READ memory access.
==2297862==Hint: address points to the zero page.
    #0 0x5029ca in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) (/Bento4/cmakebuild/mp42hevc+0x5029ca)
    #1 0x503176 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/Bento4/cmakebuild/mp42hevc+0x503176)
    #2 0x4f95fe in main (/Bento4/cmakebuild/mp42hevc+0x4f95fe)
    #3 0x7f76d743ec86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x41d999 in _start (/Bento4/cmakebuild/mp42hevc+0x41d999)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/Bento4/cmakebuild/mp42hevc+0x5029ca) in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool)
==2297862==ABORTING

```


# POC
[POC_mp42hevc_1.zip](https://github.com/axiomatic-systems/Bento4/files/9709839/POC_mp42hevc_1.zip)

# Environment

Ubuntu 18.04.6 LTS (docker)
clang 12.0.1
clang++ 12.0.1
Bento4 master branch(5b7cc25) && Bento4 release version([1.6.0-639](https://www.bok.net/Bento4/binaries/Bento4-SDK-1-6-0-639.x86_64-unknown-linux.zip))



# Credit
Xudong Cao ([NCNIPC of China](http://www.nipc.org.cn/))
Jiayuan Zhang ([NCNIPC of China](http://www.nipc.org.cn/))
Han Zheng ([NCNIPC of China](http://www.nipc.org.cn/), [Hexhive](http://hexhive.epfl.ch/))


Thank you for your time!
SEGV on unknown address in mp42hevc
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : SEGV on unknown address in mp42hevc
Issue date:

--- start body ---
# Summary
Hi, developers of Bento4:
I tested the binary mp42hevc with my fuzzer, and a crash incurred—SEGV on unknown address in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool). The following is the details.


# Bug
Detected SEGV on unknown address in AP4_File::ParseStream.
```
root@2e47aa8b3277:/# ./Bento4/cmakebuild/mp42hevc POC_mp42hevc_1 /dev/null
ERROR: cannot open input (-4)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2297862==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005029ca bp 0x7ffda4602cd0 sp 0x7ffda4602ba0 T0)
==2297862==The signal is caused by a READ memory access.
==2297862==Hint: address points to the zero page.
    #0 0x5029ca in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) (/Bento4/cmakebuild/mp42hevc+0x5029ca)
    #1 0x503176 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/Bento4/cmakebuild/mp42hevc+0x503176)
    #2 0x4f95fe in main (/Bento4/cmakebuild/mp42hevc+0x4f95fe)
    #3 0x7f76d743ec86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x41d999 in _start (/Bento4/cmakebuild/mp42hevc+0x41d999)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/Bento4/cmakebuild/mp42hevc+0x5029ca) in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool)
==2297862==ABORTING

```


# POC
[POC_mp42hevc_1.zip](https://github.com/axiomatic-systems/Bento4/files/9709839/POC_mp42hevc_1.zip)

# Environment

Ubuntu 18.04.6 LTS (docker)
clang 12.0.1
clang++ 12.0.1
Bento4 master branch(5b7cc25) && Bento4 release version([1.6.0-639](https://www.bok.net/Bento4/binaries/Bento4-SDK-1-6-0-639.x86_64-unknown-linux.zip))



# Credit
Xudong Cao ([NCNIPC of China](http://www.nipc.org.cn/))
Jiayuan Zhang ([NCNIPC of China](http://www.nipc.org.cn/))
Han Zheng ([NCNIPC of China](http://www.nipc.org.cn/), [Hexhive](http://hexhive.epfl.ch/))


Thank you for your time!
--- end body ---
