[FFmpeg-devel] [PATCH] avcodec/dolby_e: Add error recovery when parse_mantissas run out of bits (PR #21117)

[Valerii Zapodovnikov via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21117 opened by Valerii Zapodovnikov (Balling)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21117
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21117.patch

Mantissas are the last data in the channel subsegment and it appears it
is sometimes missing a very few bits for the parsing to complete.
This must not be confused with data corruption.
In standard conditions with certified products, it has been observed
that the occurence of this issue is pretty steady and about once every 2
hours. The truncation is at about 950 out of the 1024 values (923 is the
minimum I have seen so far).
The current code raises a severe 'Read past end' error and all data is
lost resulting in 20ms(@25fps) of silence for the affected channel.
This patch introduces a tolerance: if 800 out of the 1024 mantissas have
been parsed, a simple warning is raised and the data is preserved.

Signed-off-by: Nicolas Gaullier <nicolas.gaullier@cji.paris>


>From 9a2d58d52c46d4d259cda5ad276b5de9f6bff4f6 Mon Sep 17 00:00:00 2001
From: Nicolas Gaullier <nicolas.gaullier@cji.paris>
Date: Sun, 7 Dec 2025 01:02:41 +0300
Subject: [PATCH] avcodec/dolby_e: Add error recovery when parse_mantissas run
 out of bits

Mantissas are the last data in the channel subsegment and it appears it
is sometimes missing a very few bits for the parsing to complete.
This must not be confused with data corruption.
In standard conditions with certified products, it has been observed
that the occurence of this issue is pretty steady and about once every 2
hours. The truncation is at about 950 out of the 1024 values (923 is the
minimum I have seen so far).
The current code raises a severe 'Read past end' error and all data is
lost resulting in 20ms(@25fps) of silence for the affected channel.
This patch introduces a tolerance: if 800 out of the 1024 mantissas have
been parsed, a simple warning is raised and the data is preserved.

Signed-off-by: Nicolas Gaullier <nicolas.gaullier@cji.paris>
---
 libavcodec/dolby_e.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/dolby_e.c b/libavcodec/dolby_e.c
index bbcb747c06..5f4ccc0478 100644
--- a/libavcodec/dolby_e.c
+++ b/libavcodec/dolby_e.c
@@ -845,6 +845,7 @@ static int parse_indices(DBEContext *s, DBEChannel *c)
     return 0;
 }
 
+#define MIN_MANTISSAS 800
 static int parse_mantissas(DBEContext *s, DBEChannel *c)
 {
     DBEGroup *g;
@@ -885,6 +886,13 @@ static int parse_mantissas(DBEContext *s, DBEChannel *c)
                     }
                 }
             } else {
+                if (i == c->nb_groups - 1
+                    && count * size1 > get_bits_left(&s->gb)
+                    && get_bits_left(&s->gb) >= 0
+                    && (int)(mnt - c->mantissas) >= MIN_MANTISSAS) {
+                    av_log(s->avctx, AV_LOG_WARNING, "Truncated mantissas @%d, highest frequencies not recoverable\n", (int)(mnt - c->mantissas));
+                    break;
+                }
                 for (k = 0; k < count; k++)
                     mnt[k] = get_sbits(&s->gb, size1) * scale;
             }
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org