heap-buffer-overflow while running hideme -f against an mp3 with no hidden message

[geeknik]

I compiled this with clang 8.0.0 and AddressSanitizer. I then grabbed a sample.mp3 off of the Interwebz and ran ./hideme sample.mp3 -f and was treated to this error.

==24995==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000d4 at pc 0x00000043331f bp 0x7ffcce75f350 sp 0x7ffcce75eaf8
READ of size 5 at 0x6020000000d4 thread T0
    #0 0x43331e in strlen /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:365:5
    #1 0x50be88 in std::char_traits<char>::length(char const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/bits/char_traits.h:267:16
    #2 0x50be88 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/bits/basic_string.h:456
    #3 0x50be88 in CustomHeader::CustomHeader(char*) /root/AudioStego/CustomHeader.cpp:18
    #4 0x508151 in FindHiddenMessage(std::vector<char, std::allocator<char> >&) /root/AudioStego/Algorithm.cpp:195:18
    #5 0x4fed2b in main /root/AudioStego/main.cpp:136:22
    #6 0x7fa5566cf09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #7 0x41fca9 in _start (/root/AudioStego/build/hideme+0x41fca9)

0x6020000000d4 is located 0 bytes to the right of 4-byte region [0x6020000000d0,0x6020000000d4)
allocated by thread T0 here:
    #0 0x4f7df2 in operator new[](unsigned long) /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:109:3
    #1 0x50bdcc in CustomHeader::CustomHeader(char*) /root/AudioStego/CustomHeader.cpp:14:17
    #2 0x508151 in FindHiddenMessage(std::vector<char, std::allocator<char> >&) /root/AudioStego/Algorithm.cpp:195:18
    #3 0x4fed2b in main /root/AudioStego/main.cpp:136:22
    #4 0x7fa5566cf09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

SUMMARY: AddressSanitizer: heap-buffer-overflow /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:365:5 in strlen

sample.zip

[danielcardeenas]

Thanks. On it