[FFmpeg-devel] [PATCH 2/2] avcodec/ac3_parser: improve false positive detection when parsing sync frames

[James Almer]

A two byte sync word is not enough to ensure we got a real syncframe, nor are
all the range checks we do in the first seven bytes. Do therefore an integrity
check for the sync frame in order to prevent the parser from filling avctx with
bogus information.

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavcodec/aac_ac3_parser.c | 38 +++++++++++++++++++++++++++++++++----
 libavcodec/aac_ac3_parser.h |  2 ++
 libavcodec/ac3_parser.c     |  1 +
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c
index b14b1e31f9..1279db6e05 100644
--- a/libavcodec/aac_ac3_parser.c
+++ b/libavcodec/aac_ac3_parser.c
@@ -24,8 +24,11 @@
 
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
+#include "libavutil/intreadwrite.h"
 #include "parser.h"
 #include "aac_ac3_parser.h"
+#include "ac3_parser.h"
+#include "ac3_parser_internal.h"
 
 int ff_aac_ac3_parse(AVCodecParserContext *s1,
                      AVCodecContext *avctx,
@@ -79,10 +82,6 @@ get_next:
     *poutbuf = buf;
     *poutbuf_size = buf_size;
 
-    /* update codec info */
-    if(s->codec_id)
-        avctx->codec_id = s->codec_id;
-
     if (got_frame) {
         /* Due to backwards compatible HE-AAC the sample rate, channel count,
            and total number of samples found in an AAC ADTS header are not
@@ -90,6 +89,34 @@ get_next:
            duration in seconds is still correct (as is the number of bits in
            the frame). */
         if (avctx->codec_id != AV_CODEC_ID_AAC) {
+            int offset = ff_ac3_find_syncword(buf, buf_size);
+
+            if (offset < 0)
+                return i;
+
+            buf += offset;
+            buf_size -= offset;
+            while (buf_size > 0) {
+                uint16_t frame_size;
+                uint8_t bsid;
+                int ret = av_ac3_parse_header(buf, buf_size, &bsid, &frame_size);
+
+                if (ret < 0 || frame_size > buf_size)
+                    return i;
+
+                /* Check for false positives since the syncword is not enough,
+                   and only for the last syncframe in the buffer, as that was
+                   used to fill AACAC3ParseContext. See section 6.1.2 of A/52. */
+                if (buf_size > frame_size) {
+                    buf += frame_size;
+                    buf_size -= frame_size;
+                    continue;
+                }
+                if (av_crc(s->crc_ctx, 0, buf + 2, frame_size - 4) != AV_RL16(buf + frame_size - 2))
+                    return i;
+                break;
+            }
+
             avctx->sample_rate = s->sample_rate;
             if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
                 av_channel_layout_uninit(&avctx->ch_layout);
@@ -110,6 +137,9 @@ FF_ENABLE_DEPRECATION_WARNINGS
             avctx->audio_service_type = s->service_type;
         }
 
+        if(s->codec_id)
+            avctx->codec_id = s->codec_id;
+
         /* Calculate the average bit rate */
         s->frame_number++;
         if (!CONFIG_EAC3_DECODER || avctx->codec_id != AV_CODEC_ID_EAC3) {
diff --git a/libavcodec/aac_ac3_parser.h b/libavcodec/aac_ac3_parser.h
index 8b93cbf84f..9d56606f2e 100644
--- a/libavcodec/aac_ac3_parser.h
+++ b/libavcodec/aac_ac3_parser.h
@@ -24,6 +24,7 @@
 #define AVCODEC_AAC_AC3_PARSER_H
 
 #include <stdint.h>
+#include "libavutil/crc.h"
 #include "avcodec.h"
 #include "parser.h"
 
@@ -44,6 +45,7 @@ typedef struct AACAC3ParseContext {
     int (*sync)(uint64_t state, struct AACAC3ParseContext *hdr_info,
             int *need_next_header, int *new_frame_start);
 
+    const AVCRC *crc_ctx;
     int channels;
     int sample_rate;
     int bit_rate;
diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
index 425e1b4742..ecbc63ce9a 100644
--- a/libavcodec/ac3_parser.c
+++ b/libavcodec/ac3_parser.c
@@ -260,6 +260,7 @@ static av_cold int ac3_parse_init(AVCodecParserContext *s1)
 {
     AACAC3ParseContext *s = s1->priv_data;
     s->header_size = AC3_HEADER_SIZE;
+    s->crc_ctx = av_crc_get_table(AV_CRC_16_ANSI);
     s->sync = ac3_sync;
     return 0;
 }
-- 
2.37.3