CVE-2022-31287

What it actually does

The vulnerability triggers an erroneous memory allocation size request in Ap4RtpAtom.cpp when parsing malformed RTP atoms inside MP4 containers, resulting in application crash or resource exhaustion.

Why it matters to the business

Media processing, transcoding, or analysis workflows that rely on Bento4 can be disrupted by crashes when handling untrusted video files, leading to service downtime and operational delays.

How an attack unfolds

An attacker creates a specially crafted MP4 file containing a malformed RTP atom designed to provoke an invalid allocation size. When the target application parses the file, the allocation error occurs and the process terminates or exhausts resources.

How to fix it

Upgrade Bento4 to a patched release that corrects the allocation logic in Ap4RtpAtom.cpp; apply input sanitization or sandbox media parsers until a fixed version is available.

How to confirm the fix worked

Reproduce the issue with known malformed RTP atom test cases to confirm crashes; inspect source changes in Ap4RtpAtom.cpp for safe allocation size computation and re-test with the same samples.

Typical attack path

1. Craft MP4 file with malformed RTP atom data
2. Deliver the file to a system running vulnerable Bento4 code
3. Trigger file parsing via local application or library call
4. Induce allocation size error causing denial of service

How to detect it

Review application crash reports and logs for allocation failures or errors referencing RTP atom processing; search for repeated abnormal memory requests during MP4 file handling.

What your security team should do

• Patch Bento4 across all media-handling services as soon as a fixed build is released
• Restrict processing of untrusted MP4 files to isolated environments
• Add runtime monitoring for allocation failures in RTP atom parsing paths