diff mbox series

[FFmpeg-devel,2/2] avcodec/ac3_parser: improve false positive detection when parsing sync frames

Message ID 20221021125604.1107-2-jamrial@gmail.com
State New
Headers show
Series [FFmpeg-devel,1/2] avcodec/ac3dec: split off code discarding garbage at the beginning of a packet | expand

Checks

Context Check Description
andriy/commit_msg_x86 warning Please wrap lines in the body of the commit message between 60 and 72 characters.
yinshiyou/commit_msg_loongarch64 warning Please wrap lines in the body of the commit message between 60 and 72 characters.
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

James Almer Oct. 21, 2022, 12:56 p.m. UTC 
A two byte sync word is not enough to ensure we got a real syncframe, nor are
all the range checks we do in the first seven bytes. Do therefore an integrity
check for the sync frame in order to prevent the parser from filling avctx with
bogus information.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/aac_ac3_parser.c | 38 +++++++++++++++++++++++++++++++++----
 libavcodec/aac_ac3_parser.h |  2 ++
 libavcodec/ac3_parser.c     |  1 +
 3 files changed, 37 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c
index b14b1e31f9..1279db6e05 100644
--- a/libavcodec/aac_ac3_parser.c
+++ b/libavcodec/aac_ac3_parser.c
@@ -24,8 +24,11 @@ 
 
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
+#include "libavutil/intreadwrite.h"
 #include "parser.h"
 #include "aac_ac3_parser.h"
+#include "ac3_parser.h"
+#include "ac3_parser_internal.h"
 
 int ff_aac_ac3_parse(AVCodecParserContext *s1,
                      AVCodecContext *avctx,
@@ -79,10 +82,6 @@  get_next:
     *poutbuf = buf;
     *poutbuf_size = buf_size;
 
-    /* update codec info */
-    if(s->codec_id)
-        avctx->codec_id = s->codec_id;
-
     if (got_frame) {
         /* Due to backwards compatible HE-AAC the sample rate, channel count,
            and total number of samples found in an AAC ADTS header are not
@@ -90,6 +89,34 @@  get_next:
            duration in seconds is still correct (as is the number of bits in
            the frame). */
         if (avctx->codec_id != AV_CODEC_ID_AAC) {
+            int offset = ff_ac3_find_syncword(buf, buf_size);
+
+            if (offset < 0)
+                return i;
+
+            buf += offset;
+            buf_size -= offset;
+            while (buf_size > 0) {
+                uint16_t frame_size;
+                uint8_t bsid;
+                int ret = av_ac3_parse_header(buf, buf_size, &bsid, &frame_size);
+
+                if (ret < 0 || frame_size > buf_size)
+                    return i;
+
+                /* Check for false positives since the syncword is not enough,
+                   and only for the last syncframe in the buffer, as that was
+                   used to fill AACAC3ParseContext. See section 6.1.2 of A/52. */
+                if (buf_size > frame_size) {
+                    buf += frame_size;
+                    buf_size -= frame_size;
+                    continue;
+                }
+                if (av_crc(s->crc_ctx, 0, buf + 2, frame_size - 4) != AV_RL16(buf + frame_size - 2))
+                    return i;
+                break;
+            }
+
             avctx->sample_rate = s->sample_rate;
             if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
                 av_channel_layout_uninit(&avctx->ch_layout);
@@ -110,6 +137,9 @@  FF_ENABLE_DEPRECATION_WARNINGS
             avctx->audio_service_type = s->service_type;
         }
 
+        if(s->codec_id)
+            avctx->codec_id = s->codec_id;
+
         /* Calculate the average bit rate */
         s->frame_number++;
         if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
diff --git a/libavcodec/aac_ac3_parser.h b/libavcodec/aac_ac3_parser.h
index 8b93cbf84f..9d56606f2e 100644
--- a/libavcodec/aac_ac3_parser.h
+++ b/libavcodec/aac_ac3_parser.h
@@ -24,6 +24,7 @@ 
 #define AVCODEC_AAC_AC3_PARSER_H
 
 #include <stdint.h>
+#include "libavutil/crc.h"
 #include "avcodec.h"
 #include "parser.h"
 
@@ -44,6 +45,7 @@  typedef struct AACAC3ParseContext {
     int (*sync)(uint64_t state, struct AACAC3ParseContext *hdr_info,
             int *need_next_header, int *new_frame_start);
 
+    const AVCRC *crc_ctx;
     int channels;
     int sample_rate;
     int bit_rate;
diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
index 425e1b4742..ecbc63ce9a 100644
--- a/libavcodec/ac3_parser.c
+++ b/libavcodec/ac3_parser.c
@@ -260,6 +260,7 @@  static av_cold int ac3_parse_init(AVCodecParserContext *s1)
 {
     AACAC3ParseContext *s = s1->priv_data;
     s->header_size = AC3_HEADER_SIZE;
+    s->crc_ctx = av_crc_get_table(AV_CRC_16_ANSI);
     s->sync = ac3_sync;
     return 0;
 }