[FFmpeg-devel] avformat/aacdec: account for small frame sizes.

Submitted by mrdegier@gmail.com on April 29, 2019, 12:32 p.m.

Details

Message ID 20190429123253.23335-1-mrdegier@gmail.com
State New
Headers show

Commit Message

mrdegier@gmail.com April 29, 2019, 12:32 p.m.
Some ADTS files have a first frame that's shorter than the 10 bytes that
are being read while checking for ID3 tags.

Fixes #7271

Signed-off-by: Menno de Gier <mrdegier@gmail.com>
---
 libavformat/aacdec.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Comments

Hendrik Leppkes April 29, 2019, 1:34 p.m.
On Mon, Apr 29, 2019 at 2:39 PM Menno de Gier <mrdegier@gmail.com> wrote:
>
> Some ADTS files have a first frame that's shorter than the 10 bytes that
> are being read while checking for ID3 tags.
>
> Fixes #7271
>

James already send another patch for this issue -
https://patchwork.ffmpeg.org/patch/12913/ - which seems to get by
without seeks, which seems better. Maybe test that one?

- Hendrik
mrdegier@gmail.com April 29, 2019, 3:39 p.m.
On Mon, Apr 29, 2019 at 3:34 PM Hendrik Leppkes <h.leppkes@gmail.com> wrote:
>
> On Mon, Apr 29, 2019 at 2:39 PM Menno de Gier <mrdegier@gmail.com> wrote:
> >
> > Some ADTS files have a first frame that's shorter than the 10 bytes that
> > are being read while checking for ID3 tags.
> >
> > Fixes #7271
> >
>
> James already send another patch for this issue -
> https://patchwork.ffmpeg.org/patch/12913/ - which seems to get by
> without seeks, which seems better. Maybe test that one?

Ah thanks, I missed that. Looks like a better patch indeed.

Patch hide | download patch | download mbox

diff --git a/libavformat/aacdec.c b/libavformat/aacdec.c
index bd324a1420..25bccfbcb8 100644
--- a/libavformat/aacdec.c
+++ b/libavformat/aacdec.c
@@ -184,6 +184,15 @@  static int adts_aac_read_packet(AVFormatContext *s, AVPacket *pkt)
         return AVERROR_INVALIDDATA;
     }
 
+    if (fsize < pkt->size) {
+        ret = avio_seek(s->pb, fsize - pkt->size, SEEK_CUR);
+        if (ret < 0) {
+            av_packet_unref(pkt);
+            return ret;
+        }
+        av_shrink_packet(pkt, fsize);
+    }
+
     ret = av_append_packet(s->pb, pkt, fsize - pkt->size);
     if (ret < 0)
         av_packet_unref(pkt);