CVE-2022-35165: 
NixOS vulnerability analysis and mitigation

An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input. The vulnerability was discovered and reported in May 2022 (GitHub Issue).

The vulnerability exists in the AP4_SgpdAtom::AP4_SgpdAtom() function where a crafted input can set entry_count to a large value (4,278,190,081). This triggers a long loop that continuously allocates memory in the payload data structure and buffer operations, eventually exhausting the system's memory resources. The issue is exacerbated by the fact that the return value of stream.Read is not checked, preventing the loop from terminating at the end of the input file (GitHub Issue).

When successfully exploited, the vulnerability can cause a Denial of Service condition by exhausting system memory. In testing, the process was observed to exhaust 65536MB of memory before failing (GitHub Issue).

The vulnerability can be triggered by providing a specially crafted MP4 file to applications using the affected Bento4 library. A proof of concept exploit has been demonstrated using the mp42aac utility (GitHub Issue).

The vulnerability affects Bento4 version 1.6.0-639. Users should upgrade to a patched version of the software when available (Ubuntu CVE).