AddressSanitizer: heap-buffer-overflow in untrunc

[BlueSheepYang]

Describe the bug

AddressSanitizer: heap-buffer-overflow in untrunc

ASAN Output

sheep@sheep-virtual-machine:~/Desktop/fuzz/untrunc$ ./untrunc -sv -dyn -dcc -dyn -dst ./out/1.mp4 ./out/default/crashes/1
Info: version 'v367-13cafed' using ffmpeg '4.4.2-0ubuntu0.22.04.1' Lavc58.134.100
Info: reading ./out/default/crashes/1
Info: parsing healthy moov atom ...
Warning: failed decoding atom: invalid atom name: 'iso'

==3974936==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000005b73 at pc 0x5fda91839367 bp 0x7fff211dd4b0 sp 0x7fff211dcc80
READ of size 4 at 0x602000005b73 thread T0
#0 0x5fda91839366 in __asan_memcpy (/home/sheep/Desktop/fuzz/untrunc/untrunc+0xe7366) (BuildId: f34bb497b760a82b3977f75bc17586e910e078ca)
#1 0x5fda91887ca4 in std::char_traits::copy(char*, char const*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/char_traits.h:437:33
#2 0x5fda91887ca4 in std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_S_copy(char*, char const*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:359:4
#3 0x5fda91887ca4 in std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_S_copy_chars(char*, char const*, char const*) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:406:9
#4 0x5fda91887ca4 in void std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_construct<char const*>(char const*, char const*, std::forward_iterator_tag) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.tcc:225:6
#5 0x5fda91887ca4 in void std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_construct_aux<char const*>(char const*, char const*, std::__false_type) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:255:11
#6 0x5fda91887ca4 in void std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_construct<char const*>(char const*, char const*) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:274:4
#7 0x5fda91887ca4 in std::__cxx11::basic_string<char, std::char_traits, std::allocator >::basic_string(char const*, unsigned long, std::allocator const&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:521:9
#8 0x5fda91887ca4 in Atom::getString[abi:cxx11](long, long) /home/sheep/Desktop/fuzz/untrunc/src/atom.cpp:401:9
#9 0x5fda918d9ec1 in Mp4::parseOk(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, bool) /home/sheep/Desktop/fuzz/untrunc/src/mp4.cpp:131:17
#10 0x5fda918cb0ba in main /home/sheep/Desktop/fuzz/untrunc/src/main.cpp:206:7
#11 0x758379029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x758379029e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#13 0x5fda917b71f4 in _start (/home/sheep/Desktop/fuzz/untrunc/untrunc+0x651f4) (BuildId: f34bb497b760a82b3977f75bc17586e910e078ca)

0x602000005b73 is located 0 bytes to the right of 3-byte region [0x602000005b70,0x602000005b73)
allocated by thread T0 here:
#0 0x5fda91874e0d in operator new(unsigned long) (/home/sheep/Desktop/fuzz/untrunc/untrunc+0x122e0d) (BuildId: f34bb497b760a82b3977f75bc17586e910e078ca)
#1 0x5fda918c4277 in __gnu_cxx::new_allocator::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:127:27
#2 0x5fda918c4277 in std::allocator_traits<std::allocator >::allocate(std::allocator&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:464:20
#3 0x5fda918c4277 in std::_Vector_base<unsigned char, std::allocator >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:346:20
#4 0x5fda918c4277 in std::_Vector_base<unsigned char, std::allocator >::_M_create_storage(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:361:33
#5 0x5fda918c4277 in std::_Vector_base<unsigned char, std::allocator >::_Vector_base(unsigned long, std::allocator const&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:305:9
#6 0x5fda918c4277 in std::vector<unsigned char, std::allocator >::vector(unsigned long, std::allocator const&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:511:9
#7 0x5fda918c4277 in FileRead::read(unsigned long) /home/sheep/Desktop/fuzz/untrunc/src/file.cpp:159:16
#8 0x5fda918d9514 in Mp4::parseOk(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, bool) /home/sheep/Desktop/fuzz/untrunc/src/mp4.cpp:114:10
#9 0x5fda918cb0ba in main /home/sheep/Desktop/fuzz/untrunc/src/main.cpp:206:7
#10 0x758379029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/sheep/Desktop/fuzz/untrunc/untrunc+0xe7366) (BuildId: f34bb497b760a82b3977f75bc17586e910e078ca) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c047fff8b10: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8b20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8b30: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8b40: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8b50: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x0c047fff8b60: fa fa fd fd fa fa fd fd fa fa fd fd fa fa[03]fa
0x0c047fff8b70: fa fa 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3974936==ABORTING

Environment info

OS: ubuntu20.04
untrunc version 'v367-13cafed'

Crashing file

[BlueSheepYang]

heap-buffer-overflow1.zip