From 146e35127fc560e65c2b2fedf5c80f1b2ff5dffb Mon Sep 17 00:00:00 2001 From: Brandon Barrante Date: Sun, 6 Sep 2026 19:36:39 +0000 Subject: [PATCH] fix(Mp42Hls): reject E-AC-3 sample descriptions with no usable dec3 atom The E-AC-3 branch of the audio-stream setup in mp42hls does AP4_Dec3Atom* dec3 = AP4_DYNAMIC_CAST(AP4_Dec3Atom, sample_description->GetDetails().GetChild(AP4_ATOM_TYPE_DEC3)); ... if (dec3->GetSubStreams()[0].acmod == 0) { ... } with no check that the cast returned non-NULL, and no check that the substreams array is non-empty. A crafted MP4 whose sample description advertises EC-3 (AP4_SAMPLE_FORMAT_EC_3) but lacks a well-formed dec3 child atom sends dec3 to NULL, and dec3->GetSubStreams()[0].acmod segfaults reading offset 12 into the zero page (issue #1043 / @sigdevel's PoC on the 'mp42hls/5' sample). Even if the dec3 atom itself is present the substreams array can be empty, in which case GetSubStreams()[0] binds a reference to a null pointer and the deref faults at the same offset one line further down. Guard the block right after the cast: reject the sample if dec3 is NULL or its substreams array has no entries, print an error matching the surrounding style (e.g. the 'unable to parse video sample description' path a few lines below), and 'goto end' to run the existing teardown. Valid E-AC-3 inputs always carry a dec3 atom with at least one substream, so nothing observable changes on the happy path. Reported-by: Alexander Shvedov Closes #1043 Signed-off-by: Brandon Barrante --- Source/C++/Apps/Mp42Hls/Mp42Hls.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp b/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp index 4700ff20..3592d637 100644 --- a/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp +++ b/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp @@ -2072,6 +2072,13 @@ main(int argc, char** argv) unsigned int number_of_channels = 0; AP4_String track_language; AP4_Dec3Atom* dec3 = AP4_DYNAMIC_CAST(AP4_Dec3Atom, sample_description->GetDetails().GetChild(AP4_ATOM_TYPE_DEC3)); + if (dec3 == NULL || dec3->GetSubStreams().ItemCount() == 0) { + // sample description says E-AC-3 but the dec3 atom is missing, wrongly + // typed, or carries no substream entries; the descriptor below reads + // dec3->GetSubStreams()[0], which would fault on either. + fprintf(stderr, "ERROR: E-AC-3 sample description is missing a usable dec3 atom\n"); + goto end; + } AP4_BitWriter bits(8); bits.Write(0xCC, 8); bits.Write(0x06, 8); // fixed value