Axiomatic Bento4 Heap-Based Buffer Overflow Vulnerability in mp42aac Component

A critical heap-based buffer overflow vulnerability has been identified in Axiomatic Bento4 versions through 1.6.0. The issue arises in the mp42aac component, specifically within the AP4_BitReader::ReadBits function. This vulnerability can be exploited remotely, leading to memory corruption by allowing attackers to manipulate heap memory beyond allocated boundaries.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling Bento4 with AddressSanitizer enabled, using Clang as the compiler. After building the application, the mp42aac tool can be used to process a crafted input file that triggers the buffer overflow. This input file can be generated using a fuzzer, such as AFL, and should be specified when running the mp42aac tool.