Axiomatic Bento4 Heap-Based Buffer Overflow Vulnerability in AP4_DataBuffer::GetData

A critical heap-based buffer overflow vulnerability has been identified in Axiomatic Bento4 versions through 1.6.0-641. The issue arises in the function AP4_DataBuffer::GetData within the library Ap4DataBuffer.h. This vulnerability can be exploited remotely, although the complexity of the attack is high and the exploitation is known to be difficult.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

The vulnerability can be reproduced using the Bento4 version 1.6.0-641. After building Bento4, the 'mp42aac' application can be used to process specially crafted files that trigger the buffer overflow. This can be done by using the AddressSanitizer tool, which will report the heap-buffer-overflow error when the vulnerability is successfully exploited.