Skip to content

Null Pointer Dereference(npd) Bug #394

@5hadowblad3

Description

@5hadowblad3

Hi, recently when I experience the new version of bento4. I find an NPD bug in program "mp42aac".

./mp42acc inputs

The bug logic is that when the data size is not large enough and apply reallocation, the reallocation does not check whether the new buffer is successfully allocated.
This is the execution trace.
4c7a.png">
image

In SetDataSize, the function realloc buffer when new size is larger than the current one.
This means the two values of two size variable are not zero.
image
In reallocation, there is no null pointer check for the return value of the allocation and leads to the crash when apply AP4_CopyMemory which is an alias of memcpy function.
image

I have uploaded the report and related bug trace to help understand this problem.
report_input.zip

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions