heap overflow in mp4v2::impl::MP4Integer32Property::Read about mp4v2

[jinyu00]

poc:

https://gitee.com/hac425/fuzz_data/blob/master/mp4v2_vtable_poc.mp4

[nluedtke]

This was assigned CVE-2018-14446.

[StilgarISCA]

Thank you for reporting this! We are looking into it.

[StilgarISCA]

It has come to our attention that there are a number of CVE's assigned to mp4v2. All of these reference a CPE of a:techsmith:mp4v2. I believe this was an educated guess by NIST as to the owner of the mp4v2 code. After all, if you search for mp4v2 this repository shows up in the results first.

@jinyu00 was the only one to have logged an issue against our fork specifically.

I want to make it clear to the community that this is repository is a fork of https://code.google.com/archive/p/mp4v2/. We have made some changes on top of it for our own purposes and they remain open source.

Our fork here is certainly vulnerable to these issues which we intend to resolve, but I'm sure most binary distributions of this library are not built off of this fork and will need to implement their own fixes and version appropriately. We will be editing the readme to clarify the nature of this fork going forward.