Hi, there.

There is an infinite loop fault caused by buffer overflow in in WritePartial, Ap4ByteStream.cpp:785, in the newest master branch 5922ba762a.


Here is the reproducing command:
~~~~
mp4info poc 
~~~~

POC:
[poc.zip](https://github.com/axiomatic-systems/Bento4/files/7014583/mp42aac-overflow-WritePartial785.zip)
(unzip first)

Here is the reproduce trace reported by ASAN:
~~~~
==135555==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000012f2ac1 at pc 0x0000004ae555 bp 0x7ffe5ff9acb0 sp 0x7ffe5ff9a460
READ of size 248 at 0x0000012f2ac1 thread T0
    #0 0x4ae554 in __asan_memcpy /dependence/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22
    #1 0x555016 in AP4_MemoryByteStream::WritePartial(void const*, unsigned int, unsigned int&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4ByteStream.cpp:785:5
    #2 0x54f4a9 in AP4_ByteStream::Write(void const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4ByteStream.cpp:77:29
    #3 0x58be0d in AP4_HdlrAtom::WriteFields(AP4_ByteStream&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4HdlrAtom.cpp:141:29
    #4 0x52be01 in AP4_Atom::Write(AP4_ByteStream&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4Atom.cpp:229:14
    #5 0x52c854 in AP4_Atom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4Atom.cpp:316:9
    #6 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #7 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #8 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #9 0x60732b in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:135:41
    #10 0x60a592 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:380:5
    #11 0x622279 in AP4_AvcSampleEntry::ToSampleDescription() /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:1146:16
    #12 0x63fba4 in AP4_StsdAtom::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:181:53
    #13 0x6a479e in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207:37
    #14 0x66004d in AP4_Track::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4Track.cpp:447:43
    #15 0x4fce5e in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1351:52
    #16 0x4fce5e in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
    #17 0x4fbed0 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
    #18 0x4f7ca0 in main /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868:13
    #19 0x7efeb30e583f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
    #20 0x41c1f8 in _start (/mnt/data/playground/Bento4/build/mp4info+0x41c1f8)

0x0000012f2ac1 is located 63 bytes to the left of global variable 'AP4_GlobalOptions::g_Entries' defined in '/mnt/data/playground/Bento4/Source/C++/Core/Ap4Utils.cpp:38:56' (0x12f2b00) of size 8
0x0000012f2ac1 is located 0 bytes to the right of global variable 'AP4_String::EmptyString' defined in '/mnt/data/playground/Bento4/Source/C++/Core/Ap4String.cpp:39:18' (0x12f2ac0) of size 1
  'AP4_String::EmptyString' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow /dependence/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22 in __asan_memcpy
Shadow bytes around the buggy address:
  0x000080256500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256520: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9
  0x000080256530: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
  0x000080256540: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
=>0x000080256550: 00 00 f9 f9 f9 f9 f9 f9[01]f9 f9 f9 f9 f9 f9 f9
  0x000080256560: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x000080256570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000802565a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==135555==ABORTING
Aborted

~~~~


Infinite loop caused by buffer overflow, in WritePartial, Ap4ByteStream.cpp:785
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : Infinite loop caused by buffer overflow, in WritePartial, Ap4ByteStream.cpp:785
Issue date:

--- start body ---
Hi, there.

There is an infinite loop fault caused by buffer overflow in in WritePartial, Ap4ByteStream.cpp:785, in the newest master branch 5922ba762a.


Here is the reproducing command:
~~~~
mp4info poc 
~~~~

POC:
[poc.zip](https://github.com/axiomatic-systems/Bento4/files/7014583/mp42aac-overflow-WritePartial785.zip)
(unzip first)

Here is the reproduce trace reported by ASAN:
~~~~
==135555==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000012f2ac1 at pc 0x0000004ae555 bp 0x7ffe5ff9acb0 sp 0x7ffe5ff9a460
READ of size 248 at 0x0000012f2ac1 thread T0
    #0 0x4ae554 in __asan_memcpy /dependence/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22
    #1 0x555016 in AP4_MemoryByteStream::WritePartial(void const*, unsigned int, unsigned int&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4ByteStream.cpp:785:5
    #2 0x54f4a9 in AP4_ByteStream::Write(void const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4ByteStream.cpp:77:29
    #3 0x58be0d in AP4_HdlrAtom::WriteFields(AP4_ByteStream&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4HdlrAtom.cpp:141:29
    #4 0x52be01 in AP4_Atom::Write(AP4_ByteStream&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4Atom.cpp:229:14
    #5 0x52c854 in AP4_Atom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4Atom.cpp:316:9
    #6 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #7 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #8 0x55a9ec in AP4_ContainerAtom::Clone() /mnt/data/playground/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:172:56
    #9 0x60732b in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:135:41
    #10 0x60a592 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:380:5
    #11 0x622279 in AP4_AvcSampleEntry::ToSampleDescription() /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:1146:16
    #12 0x63fba4 in AP4_StsdAtom::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:181:53
    #13 0x6a479e in AP4_AtomSampleTable::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4AtomSampleTable.cpp:207:37
    #14 0x66004d in AP4_Track::GetSampleDescription(unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4Track.cpp:447:43
    #15 0x4fce5e in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1351:52
    #16 0x4fce5e in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
    #17 0x4fbed0 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
    #18 0x4f7ca0 in main /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868:13
    #19 0x7efeb30e583f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
    #20 0x41c1f8 in _start (/mnt/data/playground/Bento4/build/mp4info+0x41c1f8)

0x0000012f2ac1 is located 63 bytes to the left of global variable 'AP4_GlobalOptions::g_Entries' defined in '/mnt/data/playground/Bento4/Source/C++/Core/Ap4Utils.cpp:38:56' (0x12f2b00) of size 8
0x0000012f2ac1 is located 0 bytes to the right of global variable 'AP4_String::EmptyString' defined in '/mnt/data/playground/Bento4/Source/C++/Core/Ap4String.cpp:39:18' (0x12f2ac0) of size 1
  'AP4_String::EmptyString' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow /dependence/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22 in __asan_memcpy
Shadow bytes around the buggy address:
  0x000080256500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256520: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9
  0x000080256530: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
  0x000080256540: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
=>0x000080256550: 00 00 f9 f9 f9 f9 f9 f9[01]f9 f9 f9 f9 f9 f9 f9
  0x000080256560: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x000080256570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080256590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000802565a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==135555==ABORTING
Aborted

~~~~


--- end body ---
