diff options
author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2019-10-06 08:01:15 +0300 |
---|---|---|
committer | Paul B Mahol <onemda@gmail.com> | 2019-10-07 23:27:18 +0300 |
commit | e5e5be4c7f607d3c04396d71f511c6b81a1cd997 (patch) | |
tree | d9ad8cbf5488080c8aa776ea37dba60800c0cac2 /libavcodec/flac_parser.c | |
parent | d03c3e85176436d06b0367b6dd926645d46a2083 (diff) |
avcodec/flac_parser: Fix off-by-one error
The flac parser uses a fifo to buffer its data. Consequently, when
searching for sync codes of flac packets, one needs to take care of
the possibility of wraparound. This is done by using an optimized start
code search that works on each of the continuous buffers separately and
by explicitly checking whether the last pre-wrap byte and the first
post-wrap byte constitute a valid sync code.
Moreover, the last MAX_FRAME_HEADER_SIZE - 1 bytes ought not to be searched
for (the start of) a sync code because a header that might be found in this
region might not be completely available. These bytes ought to be searched
lateron when more data is available or when flushing.
Unfortunately there was an off-by-one error in the calculation of the
length to search of the post-wrap buffer: It was too large, because the
calculation was based on the amount of bytes available in the fifo from
the last pre-wrap byte onwards. This meant that a header might be
parsed twice (once prematurely and once regularly when more data is
available); it could also mean that an invalid header will be treated as
valid (namely if the length of said invalid header is
MAX_FRAME_HEADER_SIZE and the invalid byte that will be treated as the
last byte of this potential header happens to be the right CRC-8).
Should a header be parsed twice, the second instance will be the best child
of the first instance; the first instance's score will be
FLAC_HEADER_BASE_SCORE - FLAC_HEADER_CHANGED_PENALTY ( = 3) higher than
the second instance's score. So the frame belonging to the first
instance will be output and it will be done as a zero length frame (the
difference of the header's offset and the child's offset). This has
serious consequences when flushing, as returning a zero length buffer
signals to the caller that no more data will be output; consequently the
last frames not yet output will be dropped.
Furthermore, a "sample/frame number mismatch in adjacent frames" warning
got output when returning the zero-length frame belonging to the first
header, because the child's sample/frame number of course didn't match
the expected sample frame/number given its parent.
filter/hdcd-mix.flac from the FATE-suite was affected by this (the last
frame was omitted) which is the reason why several FATE-tests needed to
be updated.
Fixes ticket #5937.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavcodec/flac_parser.c')
-rw-r--r-- | libavcodec/flac_parser.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/flac_parser.c b/libavcodec/flac_parser.c index 2658d3c4dc..197f234e61 100644 --- a/libavcodec/flac_parser.c +++ b/libavcodec/flac_parser.c @@ -244,9 +244,9 @@ static int find_new_headers(FLACParseContext *fpc, int search_start) uint8_t wrap[2]; wrap[0] = buf[read_len - 1]; - read_len = search_end - search_start + 1; - /* search_start + 1 is the post-wrap offset in the fifo. */ + read_len = search_end - (search_start + 1) + 1; + buf = flac_fifo_read(fpc, search_start + 1, &read_len); wrap[1] = buf[0]; |