Out-of-bounds read in quicktimevideo.cpp

[kevinbackhouse]

Reported by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50629

There's an out-of-bounds read here:

exiv2/src/quicktimevideo.cpp

Line 671 in e4adf38

xmpData_["Xmp.video.PreviewAtomType"] = Exiv2::toString(buf.data());

The problem is that the buffer hasn't been nul-terminated.

quicktimevideo.cpp is a brand new file, so this definitely doesn't affect any released versions of exiv2.

poc: https://user-images.githubusercontent.com/4358136/186881088-a2b8c10c-c2b5-4f98-bc41-7736e86cbf1b.mp4

To reproduce (with an ASAN build)

exiv2 poc.mp4

[1div0]

I told you so. Video is way too complicated.

[kevinbackhouse]

@1div0: I'm not worried about it (from a security perspective). quicktimevideo.cpp looks fairly simple to me, so we should be able to iron these bugs out quite quickly. OSS-Fuzz found this one day after the pull request was merged, so I think we have good test coverage.

[1div0]

@kevinbackhouse thank you so much for all your efforts to make Exiv2 secure.

MPEG-4 Systems is simply put can of worms.