A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again in the destructor once an exception is triggered.
The product calls free() twice on the same memory address.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mp4v2 | Techsmith | 2.0.0 (including) | 2.0.0 (including) |
| Mp4v2 | Ubuntu | artful | * |
| Mp4v2 | Ubuntu | bionic | * |
| Mp4v2 | Ubuntu | cosmic | * |
| Mp4v2 | Ubuntu | esm-apps/bionic | * |
| Mp4v2 | Ubuntu | esm-apps/xenial | * |
| Mp4v2 | Ubuntu | trusty | * |
| Mp4v2 | Ubuntu | upstream | * |
| Mp4v2 | Ubuntu | xenial | * |