Bento4 mp42avc Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A buffer overflow vulnerability has been identified in Bento4's mp42avc application, specifically in the commit related to this issue. This vulnerability allows a local attacker to execute arbitrary code by exploiting the AP4_File::ParseStream function and related stream parsing functions. The issue arises from improper handling of data streams, leading to memory corruption that can be manipulated to execute malicious code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by using the mp42avc application with a crafted input file that triggers the buffer overflow during the stream parsing process. This can be done by specifying the input file containing the exploit payload when running the mp42avc command.