Bento4 Floating-Point Exception Vulnerability in TfraAtom Function

A floating-point exception vulnerability has been identified in the Bento4 media processing library, specifically within the 'mp42hevc' component. This vulnerability arises in the 'AP4_TfraAtom::AP4_TfraAtom' function, where improper handling of data can lead to a floating-point exception, potentially causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a floating-point exception, causing a denial-of-service condition by terminating the process with the error.

Reproduction

The vulnerability can be reproduced by using the Bento4 'mp42hevc' application. After applying the related Bento4 commit '3bdc891', the application can be run with a specially crafted input file that triggers the vulnerability. This can be done by using the AddressSanitizer tool, which will report the floating-point exception error when the vulnerability is successfully exploited.