# **Summary**
Hi, developers of Bento4:
I tested the binary **mp4pssh** with my fuzzer, and two crash incurred—SEGV on unknown address, and they appear in different locations. The following is the details.

# **Bug1**
SEGV on unknown address in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&).
```
root@e79sdsjkb20sa:/fuzz-mp4pssh/mp4pssh# ./mp4pssh ../out/crashes/poc_mp4pssh_269182975 /dev/null
WARNING: atom serialized to fewer bytes than declared size
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3094421==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000553d62 bp 0x7fff73512f20 sp 0x7fff735115c0 T0)
==3094421==The signal is caused by a READ memory access.
==3094421==Hint: address points to the zero page.
    #0 0x553d62 in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x553d62)
    #1 0x56c78d in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x56c78d)
    #2 0x40fe8e in main (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x40fe8e)
    #3 0x7f54bb438c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x407b19 in _start (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x407b19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x553d62) in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&)
==3094421==ABORTING

```

# **Bug2**
Detected SEGV on unknown address in AP4_AtomParent::RemoveChild(AP4_Atom*).
```
root@e79sdsjkb20sa:/fuzz-mp4pssh/mp4pssh# ./mp4pssh POC_mp4pssh_442355513 /dev/null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3191670==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000432e75 bp 0x7ffd47cbd310 sp 0x7ffd47cbb6b0 T0)
==3191670==The signal is caused by a READ memory access.
==3191670==Hint: address points to the zero page.
    #0 0x432e75 in AP4_AtomParent::RemoveChild(AP4_Atom*) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x432e75)
    #1 0x55dea7 in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x55dea7)
    #2 0x40fe8e in main (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x40fe8e)
    #3 0x7effed350c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x407b19 in _start (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x407b19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x432e75) in AP4_AtomParent::RemoveChild(AP4_Atom*)
==3191670==ABORTING

```

# **POC**

[POC_mp4pssh_269182975.zip](https://github.com/axiomatic-systems/Bento4/files/9675208/POC_mp4pssh_269182975.zip)
[POC_mp4pssh_442355513.zip](https://github.com/axiomatic-systems/Bento4/files/9713222/POC_mp4pssh_442355513.zip)


# **Environment**

Ubuntu 18.04.6 LTS (docker)
clang 12.0.1
clang++ 12.0.1
Bento4 master branch(5b7cc25) && Bento4 release version([1.6.0-639](https://www.bok.net/Bento4/binaries/Bento4-SDK-1-6-0-639.x86_64-unknown-linux.zip))



# **Credit**
Xudong Cao ([NCNIPC of China](http://www.nipc.org.cn/))
Jiayuan Zhang ([NCNIPC of China](http://www.nipc.org.cn/))
Han Zheng ([NCNIPC of China](http://www.nipc.org.cn/), [Hexhive](http://hexhive.epfl.ch/))


Thank you for your time!
SEGV on unknown address 0x000000000000 in mp4pssh
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : SEGV on unknown address 0x000000000000 in mp4pssh
Issue date:

--- start body ---
# **Summary**
Hi, developers of Bento4:
I tested the binary **mp4pssh** with my fuzzer, and two crash incurred—SEGV on unknown address, and they appear in different locations. The following is the details.

# **Bug1**
SEGV on unknown address in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&).
```
root@e79sdsjkb20sa:/fuzz-mp4pssh/mp4pssh# ./mp4pssh ../out/crashes/poc_mp4pssh_269182975 /dev/null
WARNING: atom serialized to fewer bytes than declared size
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3094421==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000553d62 bp 0x7fff73512f20 sp 0x7fff735115c0 T0)
==3094421==The signal is caused by a READ memory access.
==3094421==Hint: address points to the zero page.
    #0 0x553d62 in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x553d62)
    #1 0x56c78d in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x56c78d)
    #2 0x40fe8e in main (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x40fe8e)
    #3 0x7f54bb438c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x407b19 in _start (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x407b19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x553d62) in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&)
==3094421==ABORTING

```

# **Bug2**
Detected SEGV on unknown address in AP4_AtomParent::RemoveChild(AP4_Atom*).
```
root@e79sdsjkb20sa:/fuzz-mp4pssh/mp4pssh# ./mp4pssh POC_mp4pssh_442355513 /dev/null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3191670==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000432e75 bp 0x7ffd47cbd310 sp 0x7ffd47cbb6b0 T0)
==3191670==The signal is caused by a READ memory access.
==3191670==Hint: address points to the zero page.
    #0 0x432e75 in AP4_AtomParent::RemoveChild(AP4_Atom*) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x432e75)
    #1 0x55dea7 in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x55dea7)
    #2 0x40fe8e in main (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x40fe8e)
    #3 0x7effed350c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #4 0x407b19 in _start (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x407b19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/fuzz-mp4pssh/mp4pssh/mp4pssh+0x432e75) in AP4_AtomParent::RemoveChild(AP4_Atom*)
==3191670==ABORTING

```

# **POC**

[POC_mp4pssh_269182975.zip](https://github.com/axiomatic-systems/Bento4/files/9675208/POC_mp4pssh_269182975.zip)
[POC_mp4pssh_442355513.zip](https://github.com/axiomatic-systems/Bento4/files/9713222/POC_mp4pssh_442355513.zip)


# **Environment**

Ubuntu 18.04.6 LTS (docker)
clang 12.0.1
clang++ 12.0.1
Bento4 master branch(5b7cc25) && Bento4 release version([1.6.0-639](https://www.bok.net/Bento4/binaries/Bento4-SDK-1-6-0-639.x86_64-unknown-linux.zip))



# **Credit**
Xudong Cao ([NCNIPC of China](http://www.nipc.org.cn/))
Jiayuan Zhang ([NCNIPC of China](http://www.nipc.org.cn/))
Han Zheng ([NCNIPC of China](http://www.nipc.org.cn/), [Hexhive](http://hexhive.epfl.ch/))


Thank you for your time!
--- end body ---
