Full-featured MP4 format and MPEG DASH library and tools
axiosys:bento4 from the portAn issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4_MemoryByteStream::WritePartial() located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure.
An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS).
A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).
A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault.
A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located in System/StdC/Ap4StdCFileByteStream.cpp, called from AP4_ByteStream::Write and AP4_HdlrAtom::WriteFields.
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, called from AP4_EsDescriptor::WriteFields and AP4_Expandable::Write.
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be dif…
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assi…
Bento4 1.6.0 has memory leaks via the mp4fragment.
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_File::AP4_File.
An issue was discovered in Bento4 through 1.6.0-639. There is a NULL pointer dereference in AP4_StszAtom::GetSampleSize.
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_StszAtom::WriteFields.
Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.
An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.
A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifie…
A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identi…
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The expl…
pkg audit reports nothing for this version.multimedia/Bento4: Fix version number DISTVERSIONSUFFIX is not part of PORTVERSION, so reintroduce and bump PORTREVISION.219fc8c090
multimedia/Bento4: update to 1.6.0-641
Changelog: https://github.com/axiomatic-systems/Bento4/compare/v1.6.0-640...v1.6.0-641
Major changes:
* Added CBCS encryption for DVHE and DVH1
* Add AC4 signaling for IMS stereo and CBI(channel based immersive) in HLS
* Added dvhe and dvh1 support to cbcs
* Add support characteristic for HLS
* Update doc
* Multiple bugfixes
* #772 mp4xx vulnerabilities can cause serious errors
* #750 Memory leaks with ASAN in mp42ts
* #856 mp4dash not working with encrypted input and --clearkey
* #859 HLS AUDIO AAC 7.1 CHANNELS 7 mistake
PR: 279611
Reported by: Älven <alster@vinterdalen.se>7fca35ed06multimedia/Bento4: compiles on aarch64 Bento4 is no broken anymore in aarch64. PR: 274157 Reported by: FiLiS <freebsdbugs@filis.org>70ffe0b120
multimedia/Bento4: update to v1.6.0-640
Major changes:
* Add missed AP4_DEFINE_DYNAMIC_CAST_ANCHOR()
* Add multi-segment option for mp4encrypt
* Fix copy of file name may not be NUL-terminated
* Fix subtitles with mp4-dash
* Fix incorrect boundary check in AP4_HdlrAtom::WriteFields resulting in global-buffer-overflow
* Bug stack memory exhaustion and program crash caused by an infinite recursion
* Add Dolby Digital Plus Atmos signaling for HLS
* add --allow-cache option
* Fix a gobal-buffer-overflow in Ap4ByteStream.cpp
* Fix mp4encrypt scans and overwrites potentially non NUL-terminated file name
* avcinfo, hevcinfo: check buffer size #656
* Fix duration of muxed mp4 video is too long
* Add DDP including JOC signaling for DASH
* Add AC4 signaling including IMS to DASH
* Add AC4 with immersive stereo (IMS) signaling for DASH
* Fix heap-Buffer-Overflow with ASAN in mp42hls
Full changelog: https://github.com/axiomatic-systems/Bento4/compare/v1.6.0-639...v1.6.0-640ffb3f52bd8multimedia/Bento4: Fix packaging Add missing header files required by multimedia/kodi-addon-inputstream.adaptive Bump portrevision PR: 269415 Reported by: debdrup5a29e56fee
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
multimedia/Bento4: unbreak replacement of 'python' The scripts have 'python3' in them but the replacement was being performed on 'python', so you would end up with 'python3.93' and some wrappers did not work.72073266a2
multimedia/Bento4: Add CPE information Approved by: portmgr (blanket)6e0f8426eb
multimedia/Bento4: Update to 1.6.0-639 Major changes: * fix warnings * minor doc update * add support for xhe-aac in mp4fragment https://github.com/axiomatic-systems/Bento4/compare/v1.6.0-638...v1.6.0-639 PR: 258596 Reported by: olgenie2e86615f6
multimedia/Bento4: Update to 1.6.0-638
The project doesn't provide a release note, and this port
wasn't updated since 2018. Commits list since last update:
https://github.com/axiomatic-systems/Bento4/compare/v1.5.1-628...v1.6.0-638
Small changes in Makefile to make portclippy happy.69c2311f45One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
Mark BROKEN on riscv64 the same as on aarch64. While here, pet portlint (whitespace). Approved by: portmgr (tier-2 blanket) Obtained from: lonesome.com build testing1be5325334
Return mmokhi@'s ports to the pool after his commit bit was safekept.bd2e6107fe
multimedia/Bento4: Add missing utilities to the installed tools Install the missing utilities (mp4dash, mp4dashclone, and mp4hls) in an appropriate path. Reported by: filis Sponsored by: The FreeBSD Foundationd2816f8759
Change cmake default behaviour to outsource. Ports that build out of source now simply can use "USES=cmake" instead of "USES=cmake:outsource". Ports that fail to build out of source now need to specify "USES=cmake:insource". I tried to only set insource where explictely needed. PR: 232038 Exp-run by: antoine707c6bf295
multimedia/Bento4: Update the port to the latest (1.5.1-624) release Sponsored by: The FreeBSD Foundation692f5e1fed
Mark these ports as broken on aarch64, and, where appropriate, on armvX. While here, pet portlint. Approved by: portmgr (tier-2 blanket)4cb19e7f87
multimedia/Bento4: Add the port to the tree Bento4 is a C++ class library and tools designed to read/write ISO-MP4 files. This format is defined in international specifications ISO/IEC: 14496-12 14496-14 14496-15 Sponsored by: Netzkommune GmbHda8105399a