Hi, there.

There is an heap overflow in ReadBits, Ap4Mp4AudioInfo.cpp:66, in the newest master branch 5922ba762a.


Here is the reproducing command:
~~~~
mp4info poc 
~~~~

POC:
[poc.zip](https://github.com/axiomatic-systems/Bento4/files/7045304/mp4info-overflow-readbits66.zip)
(unzip first)

Here is the reproduce trace reported by ASAN:
~~~~
==41862==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000274 at pc 0x00000052953f bp 0x7fff6f9051a0 sp 0x7fff6f905198
 READ of size 1 at 0x602000000274 thread T0
     #0 0x52953e in AP4_Mp4AudioDsiParser::ReadBits(unsigned int) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:66:56
     #1 0x526bc5 in AP4_Mp4AudioDecoderConfig::ParseExtension(AP4_Mp4AudioDsiParser&) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:136:48
     #2 0x528b7e in AP4_Mp4AudioDecoderConfig::Parse(unsigned char const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:315:30
     #3 0x610d89 in AP4_MpegAudioSampleDescription::GetCodecString(AP4_String&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:1054:52
     #4 0x502545 in ShowSampleDescription_Text(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:395:11
     #5 0x4fcf15 in ShowSampleDescription(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1044:27
     #6 0x4fcf15 in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1354:9
     #7 0x4fcf15 in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
     #8 0x4fc062 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
     #9 0x4f7ca0 in main /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868:13
     #10 0x7f795ea9d83f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
     #11 0x41c1f8 in _start (/mnt/data/playground/Bento4/build/mp4info+0x41c1f8)
 
 0x602000000274 is located 0 bytes to the right of 4-byte region [0x602000000270,0x602000000274)
 allocated by thread T0 here:
     #0 0x4f2bb8 in operator new[](unsigned long) /dependence/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:102
     #1 0x57835a in AP4_DataBuffer::AP4_DataBuffer(void const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:68:20
     #2 0x610d89 in AP4_MpegAudioSampleDescription::GetCodecString(AP4_String&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:1054:52
     #3 0x502545 in ShowSampleDescription_Text(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:395:11
     #4 0x4fcf15 in ShowSampleDescription(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1044:27
     #5 0x4fcf15 in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1354:9
     #6 0x4fcf15 in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
     #7 0x4fc062 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:66:56 in AP4_Mp4AudioDsiParser::ReadBits(unsigned int)
 Shadow bytes around the buggy address:
   0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
   0x0c047fff8010: fa fa 04 fa fa fa 01 fa fa fa 00 04 fa fa 00 fa
   0x0c047fff8020: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa 04 fa
   0x0c047fff8030: fa fa 06 fa fa fa 00 fa fa fa 00 04 fa fa 01 fa
 =>0x0c047fff8040: fa fa 07 fa fa fa fd fd fa fa 04 fa fa fa[04]fa
   0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
   Shadow gap:              cc
 ==41862==ABORTING

~~~~

Heap overflow in mp4info, ReadBits, Ap4Mp4AudioInfo.cpp:66
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : Heap overflow in mp4info, ReadBits, Ap4Mp4AudioInfo.cpp:66
Issue date:

--- start body ---
Hi, there.

There is an heap overflow in ReadBits, Ap4Mp4AudioInfo.cpp:66, in the newest master branch 5922ba762a.


Here is the reproducing command:
~~~~
mp4info poc 
~~~~

POC:
[poc.zip](https://github.com/axiomatic-systems/Bento4/files/7045304/mp4info-overflow-readbits66.zip)
(unzip first)

Here is the reproduce trace reported by ASAN:
~~~~
==41862==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000274 at pc 0x00000052953f bp 0x7fff6f9051a0 sp 0x7fff6f905198
 READ of size 1 at 0x602000000274 thread T0
     #0 0x52953e in AP4_Mp4AudioDsiParser::ReadBits(unsigned int) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:66:56
     #1 0x526bc5 in AP4_Mp4AudioDecoderConfig::ParseExtension(AP4_Mp4AudioDsiParser&) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:136:48
     #2 0x528b7e in AP4_Mp4AudioDecoderConfig::Parse(unsigned char const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:315:30
     #3 0x610d89 in AP4_MpegAudioSampleDescription::GetCodecString(AP4_String&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:1054:52
     #4 0x502545 in ShowSampleDescription_Text(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:395:11
     #5 0x4fcf15 in ShowSampleDescription(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1044:27
     #6 0x4fcf15 in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1354:9
     #7 0x4fcf15 in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
     #8 0x4fc062 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
     #9 0x4f7ca0 in main /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1868:13
     #10 0x7f795ea9d83f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
     #11 0x41c1f8 in _start (/mnt/data/playground/Bento4/build/mp4info+0x41c1f8)
 
 0x602000000274 is located 0 bytes to the right of 4-byte region [0x602000000270,0x602000000274)
 allocated by thread T0 here:
     #0 0x4f2bb8 in operator new[](unsigned long) /dependence/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:102
     #1 0x57835a in AP4_DataBuffer::AP4_DataBuffer(void const*, unsigned int) /mnt/data/playground/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:68:20
     #2 0x610d89 in AP4_MpegAudioSampleDescription::GetCodecString(AP4_String&) /mnt/data/playground/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:1054:52
     #3 0x502545 in ShowSampleDescription_Text(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:395:11
     #4 0x4fcf15 in ShowSampleDescription(AP4_SampleDescription&, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1044:27
     #5 0x4fcf15 in ShowTrackInfo_Text(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1354:9
     #6 0x4fcf15 in ShowTrackInfo(AP4_Movie&, AP4_Track&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1475:13
     #7 0x4fc062 in ShowTracks(AP4_Movie&, AP4_List<AP4_Track>&, AP4_ByteStream&, bool, bool, bool, bool) /mnt/data/playground/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1586:9
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/data/playground/Bento4/Source/C++/Codecs/Ap4Mp4AudioInfo.cpp:66:56 in AP4_Mp4AudioDsiParser::ReadBits(unsigned int)
 Shadow bytes around the buggy address:
   0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
   0x0c047fff8010: fa fa 04 fa fa fa 01 fa fa fa 00 04 fa fa 00 fa
   0x0c047fff8020: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa 04 fa
   0x0c047fff8030: fa fa 06 fa fa fa 00 fa fa fa 00 04 fa fa 01 fa
 =>0x0c047fff8040: fa fa 07 fa fa fa fd fd fa fa 04 fa fa fa[04]fa
   0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
   Shadow gap:              cc
 ==41862==ABORTING

~~~~

--- end body ---
