[FFmpeg-devel] [PATCH 2/2] avformat/iamf_parse: fix parsing AAC DecoderConfigDescriptor

[James Almer]

Use ff_mp4_read_descr() to read both the tags and the vlc value
that comes after it, which was not being taken into account.

Ref: https://github.com/AOMediaCodec/libiamf/issues/119

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavformat/iamf_parse.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 080c1a457a..8890bcf7ae 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -62,12 +62,12 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
 {
     MPEG4AudioConfig cfg = { 0 };
     int object_type_id, codec_id, stream_type;
-    int ret, tag, left;
+    int ret, tag;
 
     if (codec_config->audio_roll_distance >= 0)
         return AVERROR_INVALIDDATA;
 
-    tag = avio_r8(pb);
+    ff_mp4_read_descr(logctx, pb, &tag);
     if (tag != MP4DecConfigDescrTag)
         return AVERROR_INVALIDDATA;
 
@@ -87,22 +87,19 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
     if (codec_id && codec_id != codec_config->codec_id)
         return AVERROR_INVALIDDATA;
 
-    tag = avio_r8(pb);
-    if (tag != MP4DecSpecificDescrTag)
-        return AVERROR_INVALIDDATA;
-
-    left = len - avio_tell(pb);
-    if (left <= 0)
+    len = ff_mp4_read_descr(logctx, pb, &tag);
+    if (tag != MP4DecSpecificDescrTag ||
+        !len || (uint64_t)len > (1<<30))
         return AVERROR_INVALIDDATA;
 
     // We pad extradata here because avpriv_mpeg4audio_get_config2() needs it.
-    codec_config->extradata = av_malloc((size_t)left + AV_INPUT_BUFFER_PADDING_SIZE);
+    codec_config->extradata = av_malloc((size_t)len + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!codec_config->extradata)
         return AVERROR(ENOMEM);
 
-    codec_config->extradata_size = avio_read(pb, codec_config->extradata, left);
-    if (codec_config->extradata_size < left)
-        return AVERROR_INVALIDDATA;
+    codec_config->extradata_size = ffio_read_size(pb, codec_config->extradata, len);
+    if (ret < 0)
+        return ret;
     memset(codec_config->extradata + codec_config->extradata_size, 0,
            AV_INPUT_BUFFER_PADDING_SIZE);
 
-- 
2.46.0