allocator out of memory in MP4_ReadBox_stts

[moonflowersl]

• Describe the bug
  We (School of Cyber Science and Technology, Shandong University) found that MP4_ReadBox_stts can cause 'allocator out of memory' when it processes malformed messages.

• Expected behavior
  If Asan is enabled at compile time, the MP4_ReadBox_stts crashes and displays ASAN information.

• Actual Behavior

  If Asan is enabled at compile time, the MP4_ReadBox_stts crashes and displays ASAN information, which can cause DOS.

  

• To Reproduce

  Similarly, we will upload a vulnerability POC to https://drive.google.com/file/d/1TV2McXfsw7tYfpUofMiaCNxGydJMjKDe/view?usp=share_link to help developers fix this vulnerability.

• Environment Details

  • Version: master branch
  • Operating system and version：Ubuntu 20.04
  • Compiler and language used：gcc 9.4.0