FPE discovered in mp42ts

[40ngx]

Hello, I used the fuzz testing tool to test mp42ts and found an FPE crash. Details are below.

Envrionment

Ubuntu 22.04.2 LTS
gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04)
Ubuntu clang version 14.0.0-1ubuntu1.1

Affected Version

(Bento4 Version 1.6.0.0)
MP4 To MPEG2-TS File Converter - Version 1.3

crash SUMMARY

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2848675==ERROR: AddressSanitizer: FPE on unknown address 0x558fbeb0610e (pc 0x558fbeb0610e bp 0x7ffe1ddf30b0 sp 0x7ffe1ddf2da0 T0)
    #0 0x558fbeb0610e in AP4_TfraAtom::AP4_TfraAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4TfraAtom.cpp:153:53
    #1 0x558fbeb056b7 in AP4_TfraAtom::Create(unsigned int, AP4_ByteStream&) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4TfraAtom.cpp:53:16
    #2 0x558fbe947785 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:443:20
    #3 0x558fbe94e43e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:234:14
    #4 0x558fbe94da71 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:154:12
    #5 0x558fbe93d986 in AP4_Atom::Clone() /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4Atom.cpp:324:18
    #6 0x558fbeab3918 in AP4_SampleDescription::AP4_SampleDescription(AP4_SampleDescription::Type, unsigned int, AP4_AtomParent*) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:138:41
    #7 0x558fbeab3918 in AP4_AvcSampleDescription::AP4_AvcSampleDescription(unsigned int, unsigned short, unsigned short, unsigned short, char const*, AP4_AtomParent*) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4SampleDescription.cpp:383:5
    #8 0x558fbeac1655 in AP4_AvcSampleEntry::ToSampleDescription() /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:1146:16
    #9 0x558fbeaeaae8 in AP4_StsdAtom::GetSampleDescription(unsigned int) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:181:53
    #10 0x558fbe912b43 in AP4_Track::GetSampleDescription(unsigned int) /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4Track.cpp:447:43
    #11 0x558fbe912b43 in main /root/fuzzing_Bento4/Bento4/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:602:43
    #12 0x7f5ba8e29d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
    #13 0x7f5ba8e29e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
    #14 0x558fbe84aa04 in _start (/root/fuzzing_Bento4/Bento4/cmakebuild/mp42ts+0xd5a04) (BuildId: e9d01274e1656fd8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /root/fuzzing_Bento4/Bento4/Source/C++/Core/Ap4TfraAtom.cpp:153:53 in AP4_TfraAtom::AP4_TfraAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&)
==2848675==ABORTING

command

./mp42ts poc4 output

poc4.zip