[FFmpeg-devel] [PATCH 1/2] avcodec/ac3dec: split off code discarding garbage at the beginning of a packet

[FFmpeg-devel] [PATCH 1/2] avcodec/ac3dec: split off code discarding garbage at the beginning of a packet

[James Almer]

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/ac3_parser.c          | 19 +++++++++++++++++++
 libavcodec/ac3_parser_internal.h |  2 ++
 libavcodec/ac3dec.c              | 15 ++-------------
 3 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
index 4f154bb7c4..425e1b4742 100644
--- a/libavcodec/ac3_parser.c
+++ b/libavcodec/ac3_parser.c
@@ -53,6 +53,25 @@ static const uint8_t center_levels[4] = { 4, 5, 6, 5 };
  */
 static const uint8_t surround_levels[4] = { 4, 6, 7, 6 };
 
+int ff_ac3_find_syncword(const uint8_t *buf, int buf_size)
+{
+    int i;
+
+    for (i = 1; i < buf_size; i += 2) {
+        if (buf[i] == 0x77 || buf[i] == 0x0B) {
+            if ((buf[i] ^ buf[i-1]) == (0x77 ^ 0x0B)) {
+                i--;
+                break;
+            } else if ((buf[i] ^ buf[i+1]) == (0x77 ^ 0x0B)) {
+                break;
+            }
+        }
+    }
+    if (i >= buf_size)
+        return AVERROR_INVALIDDATA;
+
+    return i;
+}
 
 int ff_ac3_parse_header(GetBitContext *gbc, AC3HeaderInfo *hdr)
 {
diff --git a/libavcodec/ac3_parser_internal.h b/libavcodec/ac3_parser_internal.h
index bd4e1bbffb..2ac0e67ec2 100644
--- a/libavcodec/ac3_parser_internal.h
+++ b/libavcodec/ac3_parser_internal.h
@@ -79,4 +79,6 @@ int ff_ac3_parse_header(GetBitContext *gbc, AC3HeaderInfo *hdr);
 int avpriv_ac3_parse_header(AC3HeaderInfo **hdr, const uint8_t *buf,
                             size_t size);
 
+int ff_ac3_find_syncword(const uint8_t *buf, int buf_size);
+
 #endif /* AVCODEC_AC3_PARSER_INTERNAL_H */
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
index 340f6e1e37..8e40587ff1 100644
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -1508,19 +1508,8 @@ static int ac3_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     s->superframe_size = 0;
 
     buf_size = full_buf_size;
-    for (i = 1; i < buf_size; i += 2) {
-        if (buf[i] == 0x77 || buf[i] == 0x0B) {
-            if ((buf[i] ^ buf[i-1]) == (0x77 ^ 0x0B)) {
-                i--;
-                break;
-            } else if ((buf[i] ^ buf[i+1]) == (0x77 ^ 0x0B)) {
-                break;
-            }
-        }
-    }
-    if (i >= buf_size)
-        return AVERROR_INVALIDDATA;
-    if (i > 10)
+    i = ff_ac3_find_syncword(buf, buf_size);
+    if (i < 0 || i > 10)
         return i;
     buf += i;
     buf_size -= i;
-- 
2.37.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/ac3_parser: improve false positive detection when parsing sync frames

[James Almer]

A two byte sync word is not enough to ensure we got a real syncframe, nor are
all the range checks we do in the first seven bytes. Do therefore an integrity
check for the sync frame in order to prevent the parser from filling avctx with
bogus information.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/aac_ac3_parser.c | 38 +++++++++++++++++++++++++++++++++----
 libavcodec/aac_ac3_parser.h |  2 ++
 libavcodec/ac3_parser.c     |  1 +
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c
index b14b1e31f9..1279db6e05 100644
--- a/libavcodec/aac_ac3_parser.c
+++ b/libavcodec/aac_ac3_parser.c
@@ -24,8 +24,11 @@
 
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
+#include "libavutil/intreadwrite.h"
 #include "parser.h"
 #include "aac_ac3_parser.h"
+#include "ac3_parser.h"
+#include "ac3_parser_internal.h"
 
 int ff_aac_ac3_parse(AVCodecParserContext *s1,
                      AVCodecContext *avctx,
@@ -79,10 +82,6 @@ get_next:
     *poutbuf = buf;
     *poutbuf_size = buf_size;
 
-    /* update codec info */
-    if(s->codec_id)
-        avctx->codec_id = s->codec_id;
-
     if (got_frame) {
         /* Due to backwards compatible HE-AAC the sample rate, channel count,
            and total number of samples found in an AAC ADTS header are not
@@ -90,6 +89,34 @@ get_next:
            duration in seconds is still correct (as is the number of bits in
            the frame). */
         if (avctx->codec_id != AV_CODEC_ID_AAC) {
+            int offset = ff_ac3_find_syncword(buf, buf_size);
+
+            if (offset < 0)
+                return i;
+
+            buf += offset;
+            buf_size -= offset;
+            while (buf_size > 0) {
+                uint16_t frame_size;
+                uint8_t bsid;
+                int ret = av_ac3_parse_header(buf, buf_size, &bsid, &frame_size);
+
+                if (ret < 0 || frame_size > buf_size)
+                    return i;
+
+                /* Check for false positives since the syncword is not enough,
+                   and only for the last syncframe in the buffer, as that was
+                   used to fill AACAC3ParseContext. See section 6.1.2 of A/52. */
+                if (buf_size > frame_size) {
+                    buf += frame_size;
+                    buf_size -= frame_size;
+                    continue;
+                }
+                if (av_crc(s->crc_ctx, 0, buf + 2, frame_size - 4) != AV_RL16(buf + frame_size - 2))
+                    return i;
+                break;
+            }
+
             avctx->sample_rate = s->sample_rate;
             if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
                 av_channel_layout_uninit(&avctx->ch_layout);
@@ -110,6 +137,9 @@ FF_ENABLE_DEPRECATION_WARNINGS
             avctx->audio_service_type = s->service_type;
         }
 
+        if(s->codec_id)
+            avctx->codec_id = s->codec_id;
+
         /* Calculate the average bit rate */
         s->frame_number++;
         if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
diff --git a/libavcodec/aac_ac3_parser.h b/libavcodec/aac_ac3_parser.h
index 8b93cbf84f..9d56606f2e 100644
--- a/libavcodec/aac_ac3_parser.h
+++ b/libavcodec/aac_ac3_parser.h
@@ -24,6 +24,7 @@
 #define AVCODEC_AAC_AC3_PARSER_H
 
 #include <stdint.h>
+#include "libavutil/crc.h"
 #include "avcodec.h"
 #include "parser.h"
 
@@ -44,6 +45,7 @@ typedef struct AACAC3ParseContext {
     int (*sync)(uint64_t state, struct AACAC3ParseContext *hdr_info,
             int *need_next_header, int *new_frame_start);
 
+    const AVCRC *crc_ctx;
     int channels;
     int sample_rate;
     int bit_rate;
diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
index 425e1b4742..ecbc63ce9a 100644
--- a/libavcodec/ac3_parser.c
+++ b/libavcodec/ac3_parser.c
@@ -260,6 +260,7 @@ static av_cold int ac3_parse_init(AVCodecParserContext *s1)
 {
     AACAC3ParseContext *s = s1->priv_data;
     s->header_size = AC3_HEADER_SIZE;
+    s->crc_ctx = av_crc_get_table(AV_CRC_16_ANSI);
     s->sync = ac3_sync;
     return 0;
 }
-- 
2.37.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".