| Message ID | 20191107161622.27855-1-lance.lmwang@gmail.com |
|---|---|
| State | New |
| Headers | show |
On Fri, Nov 08, 2019 at 12:16:22AM +0800, lance.lmwang@gmail.com wrote: > From: Limin Wang <lance.lmwang@gmail.com> > > Signed-off-by: Limin Wang <lance.lmwang@gmail.com> > --- > By Hendrik comments, I have proposal a more general fix for > more common case. > Now It's only tested with fate and all samples in: > http://samples.ffmpeg.org/A-codecs/MP3-pro > http://samples.ffmpeg.org/A-codecs/MP3 > > libavformat/mp3dec.c | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) > > diff --git a/libavformat/mp3dec.c b/libavformat/mp3dec.c > index 258f191..551aa56 100644 > --- a/libavformat/mp3dec.c > +++ b/libavformat/mp3dec.c > @@ -73,7 +73,8 @@ static int mp3_read_probe(const AVProbeData *p) > int frames, ret; > int framesizes, max_framesizes; > uint32_t header; > - const uint8_t *buf, *buf0, *buf2, *end; > + uint32_t next_sync; > + const uint8_t *buf, *buf0, *buf2, *buf3, *end; > > buf0 = p->buf; > end = p->buf + p->buf_size - sizeof(uint32_t); > @@ -93,6 +94,16 @@ static int mp3_read_probe(const AVProbeData *p) > ret = avpriv_mpegaudio_decode_header(&h, header); > if (ret != 0) > break; > + > + buf3 = buf2 + 4; > + while (buf3 < end) { > + next_sync = AV_RB32(buf3); > + if ((next_sync & MP3_MASK) == (header & MP3_MASK)) > + break; > + buf3++; > + } > + if (buf3 - buf2 != h.frame_size) > + break; iam not sure if a single occurance of the header should trigger rejection of the frame, the failing sample has hundreads ill post a modified version of this in a moment which is a bit simpler and counts these cases Thanks [...]
diff --git a/libavformat/mp3dec.c b/libavformat/mp3dec.c index 258f191..551aa56 100644 --- a/libavformat/mp3dec.c +++ b/libavformat/mp3dec.c @@ -73,7 +73,8 @@ static int mp3_read_probe(const AVProbeData *p) int frames, ret; int framesizes, max_framesizes; uint32_t header; - const uint8_t *buf, *buf0, *buf2, *end; + uint32_t next_sync; + const uint8_t *buf, *buf0, *buf2, *buf3, *end; buf0 = p->buf; end = p->buf + p->buf_size - sizeof(uint32_t); @@ -93,6 +94,16 @@ static int mp3_read_probe(const AVProbeData *p) ret = avpriv_mpegaudio_decode_header(&h, header); if (ret != 0) break; + + buf3 = buf2 + 4; + while (buf3 < end) { + next_sync = AV_RB32(buf3); + if ((next_sync & MP3_MASK) == (header & MP3_MASK)) + break; + buf3++; + } + if (buf3 - buf2 != h.frame_size) + break; buf2 += h.frame_size; framesizes += h.frame_size; }