[FFmpeg-devel] [PATCH 2/2] avformat/mp3dec: Check for occurances of headers within frames during probing

[Hendrik Leppkes]

On Thu, Nov 7, 2019 at 10:34 PM Michael Niedermayer
<michael at niedermayer.cc> wrote:
>
> From: Limin Wang <lance.lmwang at gmail.com>
>
> Fixes misdetection of zYLx.wav
>
> Co-Author: Michael Niedermayer <michael at niedermayer.cc>
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/mp3dec.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/mp3dec.c b/libavformat/mp3dec.c
> index 6848415657..eb40362548 100644
> --- a/libavformat/mp3dec.c
> +++ b/libavformat/mp3dec.c
> @@ -73,7 +73,7 @@ static int mp3_read_probe(const AVProbeData *p)
>      int frames, ret;
>      int framesizes, max_framesizes;
>      uint32_t header;
> -    const uint8_t *buf, *buf0, *buf2, *end;
> +    const uint8_t *buf, *buf0, *buf2, *buf3, *end;
>
>      buf0 = p->buf;
>      end = p->buf + p->buf_size - sizeof(uint32_t);
> @@ -88,11 +88,19 @@ static int mp3_read_probe(const AVProbeData *p)
>          buf2 = buf;
>          for(framesizes = frames = 0; buf2 < end; frames++) {
>              MPADecodeHeader h;
> +            int header_emu = 0;
>
>              header = AV_RB32(buf2);
>              ret = avpriv_mpegaudio_decode_header(&h, header);
>              if (ret != 0 || end - buf2 < h.frame_size)
>                  break;
> +
> +            for (buf3 = buf2 + 4; buf3 < buf2 + h.frame_size; buf3++) {
> +                uint32_t next_sync = AV_RB32(buf3);
> +                header_emu += (next_sync & MP3_MASK) == (header & MP3_MASK);
> +            }
> +            if (header_emu > 2)
> +                break;
>              buf2 += h.frame_size;
>              framesizes += h.frame_size;
>          }

I still have the same question - how possible is it that the actual
audio data actually has these same bits? Is it actually impossible? Or
are we just trading detection flaws here?

-  Hendrik