@@ -23,10 +23,11 @@
#include "libavutil/intreadwrite.h"
#include "avformat.h"
#include "internal.h"
-#include "rawdec.h"
#include "id3v1.h"
#include "apetag.h"
+#define ADTS_HEADER_SIZE 7
+
static int adts_aac_probe(AVProbeData *p)
{
int max_frames = 0, first_frames = 0;
@@ -102,12 +103,38 @@ static int adts_aac_read_header(AVFormatContext *s)
return 0;
}
+static int adts_aac_read_packet(AVFormatContext *s, AVPacket *pkt)
+{
+ int ret, fsize;
+
+ ret = av_get_packet(s->pb, pkt, ADTS_HEADER_SIZE);
+ if (ret < 0)
+ return ret;
+ if (ret < ADTS_HEADER_SIZE) {
+ av_packet_unref(pkt);
+ return AVERROR(EIO);
+ }
+
+ if ((AV_RB16(pkt->data) >> 4) != 0xfff) {
+ av_packet_unref(pkt);
+ return AVERROR_INVALIDDATA;
+ }
+
+ fsize = (AV_RB32(pkt->data + 3) >> 13) & 0x1FFF;
+ if (fsize < ADTS_HEADER_SIZE) {
+ av_packet_unref(pkt);
+ return AVERROR_INVALIDDATA;
+ }
+
+ return av_append_packet(s->pb, pkt, fsize - ADTS_HEADER_SIZE);
+}
+
AVInputFormat ff_aac_demuxer = {
.name = "aac",
.long_name = NULL_IF_CONFIG_SMALL("raw ADTS AAC (Advanced Audio Coding)"),
.read_probe = adts_aac_probe,
.read_header = adts_aac_read_header,
- .read_packet = ff_raw_read_partial_packet,
+ .read_packet = adts_aac_read_packet,
.flags = AVFMT_GENERIC_INDEX,
.extensions = "aac",
.mime_type = "audio/aac,audio/aacp,audio/x-aac",
Atempt to read and propagate only full ADTS frames and not other data, like id3v1 or APETags at the end of the file. Fixes ticket #6439. Signed-off-by: James Almer <jamrial@gmail.com> --- libavformat/aacdec.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-)