Bento4 Buffer Overflow Vulnerability in AP4_Stz2Atom Component

A buffer overflow vulnerability has been identified in Bento4 version 1.6.0-641. This vulnerability allows local attackers to execute arbitrary code by exploiting the AP4_Stz2Atom component in Ap4Stz2Atom.cpp. The issue arises when the mp4fragment tool processes specially crafted MP4 files, leading to memory corruption and potential execution of malicious code.

Impact

Exploitation of this vulnerability causes a heap buffer overflow, allowing for memory corruption and arbitrary code execution.

Reproduction

The vulnerability can be reproduced using the Bento4 mp4fragment tool. After building Bento4, the mp4fragment application can be executed with a crafted MP4 file that triggers the buffer overflow. This can be done by using the 'bug6.mp4' file, which is available in the Bento4_PoC repository on GitHub.