CVE-2017-12476: NULL Pointer Dereference (CWE-476)
value: The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-09-06T08:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4AtomSampleTable.cpp, Source/C++/Core/Ap4AvccAtom.cpp, Source/C++/Core/Ap4Processor.cpp, Source/C++/Core/Ap4Version.h
Commit date: 2017-07-30 15:29:24 -0700
Commit message: fixed possible crashes on malformed inputs.

Diff: diff --git a/Source/C++/Core/Ap4AtomSampleTable.cpp b/Source/C++/Core/Ap4AtomSampleTable.cpp
index 19e05da..77d1119 100644
--- a/Source/C++/Core/Ap4AtomSampleTable.cpp
+++ b/Source/C++/Core/Ap4AtomSampleTable.cpp
@@ -85,10 +85,15 @@ AP4_Result
 AP4_AtomSampleTable::GetSample(AP4_Ordinal index, 
                                AP4_Sample& sample)
 {
     AP4_Result result;
 
+    // check that we have an stsc atom
+    if (!m_StscAtom) {
+        return AP4_ERROR_INVALID_FORMAT;
+    }
+    
     // check that we have a chunk offset table
     if (m_StcoAtom == NULL && m_Co64Atom == NULL) {
         return AP4_ERROR_INVALID_FORMAT;
     }
 
diff --git a/Source/C++/Core/Ap4AvccAtom.cpp b/Source/C++/Core/Ap4AvccAtom.cpp
index a1167d0..d14f9a6 100644
--- a/Source/C++/Core/Ap4AvccAtom.cpp
+++ b/Source/C++/Core/Ap4AvccAtom.cpp
@@ -268,10 +268,10 @@ AP4_AvccAtom::InspectFields(AP4_AtomInspector& inspector)
     inspector.AddField("Level", m_Level);
     inspector.AddField("NALU Length Size", m_NaluLengthSize);
     for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
         inspector.AddField("Sequence Parameter", m_SequenceParameters[i].GetData(), m_SequenceParameters[i].GetDataSize());
     }
-    for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
+    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
         inspector.AddField("Picture Parameter", m_PictureParameters[i].GetData(), m_PictureParameters[i].GetDataSize());
     }
     return AP4_SUCCESS;
 }
diff --git a/Source/C++/Core/Ap4Processor.cpp b/Source/C++/Core/Ap4Processor.cpp
index ae6eb7d..9c1a7ec 100644
--- a/Source/C++/Core/Ap4Processor.cpp
+++ b/Source/C++/Core/Ap4Processor.cpp
@@ -552,10 +552,11 @@ AP4_Processor::Process(AP4_ByteStream&   input,
             // see which is the next sample to write
             AP4_UI64 min_offset = (AP4_UI64)(-1);
             int cursor = -1;
             for (unsigned int i=0; i<track_count; i++) {
                 if (!cursors[i].m_EndReached &&
+                    cursors[i].m_Locator.m_SampleTable &&
                     cursors[i].m_Locator.m_Sample.GetOffset() <= min_offset) {
                     min_offset = cursors[i].m_Locator.m_Sample.GetOffset();
                     cursor = i;
                 }
             }
diff --git a/Source/C++/Core/Ap4Version.h b/Source/C++/Core/Ap4Version.h
index 60620af..5ffb7f6 100644
--- a/Source/C++/Core/Ap4Version.h
+++ b/Source/C++/Core/Ap4Version.h
@@ -35,9 +35,9 @@
 |   version constants
 +---------------------------------------------------------------------*/
 /**
  * Version number of the SDK
  */
-#define AP4_VERSION        0x01050000
-#define AP4_VERSION_STRING "1.5.0.0"
+#define AP4_VERSION        0x01050001
+#define AP4_VERSION_STRING "1.5.0.1"
 
 #endif // _AP4_VERSION_H_

Vulnerable code:     for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
#define AP4_VERSION        0x01050000
#define AP4_VERSION_STRING "1.5.0.0"
Fixed code:     // check that we have an stsc atom
    if (!m_StscAtom) {
        return AP4_ERROR_INVALID_FORMAT;
    }
    
    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
                    cursors[i].m_Locator.m_SampleTable &&
#define AP4_VERSION        0x01050001
#define AP4_VERSION_STRING "1.5.0.1"