Bento4 Mp42avc Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A buffer overflow vulnerability has been identified in Bento4's mp42avc application, specifically in the commit related to this issue. This vulnerability allows a local attacker to execute arbitrary code by exploiting the AP4_MemoryByteStream::WritePartial function. The issue arises from improper handling of data, leading to memory corruption that can be manipulated to execute malicious code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by using the mp42avc application with a crafted input file that triggers the buffer overflow. This can be done by specifying the input file when running the mp42avc command, directing the output to /dev/null. The AddressSanitizer will report the memory corruption caused by the vulnerability.