A two byte sync word is not enough to ensure we got a real syncframe, nor are all the range checks we do in the first seven bytes. Do therefore an integrity check for the sync frame in order to prevent the parser from filling avctx with bogus information.
Signed-off-by: James Almer <[email protected]> --- libavcodec/aac_ac3_parser.c | 38 +++++++++++++++++++++++++++++++++---- libavcodec/aac_ac3_parser.h | 2 ++ libavcodec/ac3_parser.c | 1 + 3 files changed, 37 insertions(+), 4 deletions(-) diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c index b14b1e31f9..1279db6e05 100644 --- a/libavcodec/aac_ac3_parser.c +++ b/libavcodec/aac_ac3_parser.c @@ -24,8 +24,11 @@ #include "libavutil/channel_layout.h" #include "libavutil/common.h" +#include "libavutil/intreadwrite.h" #include "parser.h" #include "aac_ac3_parser.h" +#include "ac3_parser.h" +#include "ac3_parser_internal.h" int ff_aac_ac3_parse(AVCodecParserContext *s1, AVCodecContext *avctx, @@ -79,10 +82,6 @@ get_next: *poutbuf = buf; *poutbuf_size = buf_size; - /* update codec info */ - if(s->codec_id) - avctx->codec_id = s->codec_id; - if (got_frame) { /* Due to backwards compatible HE-AAC the sample rate, channel count, and total number of samples found in an AAC ADTS header are not @@ -90,6 +89,34 @@ get_next: duration in seconds is still correct (as is the number of bits in the frame). */ if (avctx->codec_id != AV_CODEC_ID_AAC) { + int offset = ff_ac3_find_syncword(buf, buf_size); + + if (offset < 0) + return i; + + buf += offset; + buf_size -= offset; + while (buf_size > 0) { + uint16_t frame_size; + uint8_t bsid; + int ret = av_ac3_parse_header(buf, buf_size, &bsid, &frame_size); + + if (ret < 0 || frame_size > buf_size) + return i; + + /* Check for false positives since the syncword is not enough, + and only for the last syncframe in the buffer, as that was + used to fill AACAC3ParseContext. See section 6.1.2 of A/52. */ + if (buf_size > frame_size) { + buf += frame_size; + buf_size -= frame_size; + continue; + } + if (av_crc(s->crc_ctx, 0, buf + 2, frame_size - 4) != AV_RL16(buf + frame_size - 2)) + return i; + break; + } + avctx->sample_rate = s->sample_rate; if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) { av_channel_layout_uninit(&avctx->ch_layout); @@ -110,6 +137,9 @@ FF_ENABLE_DEPRECATION_WARNINGS avctx->audio_service_type = s->service_type; } + if(s->codec_id) + avctx->codec_id = s->codec_id; + /* Calculate the average bit rate */ s->frame_number++; if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) { diff --git a/libavcodec/aac_ac3_parser.h b/libavcodec/aac_ac3_parser.h index 8b93cbf84f..9d56606f2e 100644 --- a/libavcodec/aac_ac3_parser.h +++ b/libavcodec/aac_ac3_parser.h @@ -24,6 +24,7 @@ #define AVCODEC_AAC_AC3_PARSER_H #include <stdint.h> +#include "libavutil/crc.h" #include "avcodec.h" #include "parser.h" @@ -44,6 +45,7 @@ typedef struct AACAC3ParseContext { int (*sync)(uint64_t state, struct AACAC3ParseContext *hdr_info, int *need_next_header, int *new_frame_start); + const AVCRC *crc_ctx; int channels; int sample_rate; int bit_rate; diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c index 425e1b4742..ecbc63ce9a 100644 --- a/libavcodec/ac3_parser.c +++ b/libavcodec/ac3_parser.c @@ -260,6 +260,7 @@ static av_cold int ac3_parse_init(AVCodecParserContext *s1) { AACAC3ParseContext *s = s1->priv_data; s->header_size = AC3_HEADER_SIZE; + s->crc_ctx = av_crc_get_table(AV_CRC_16_ANSI); s->sync = ac3_sync; return 0; } -- 2.37.3 _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
