[FFmpeg-trac] #10246(avformat:new): AIFF file with invalid ID3 chunk fails

[FFmpeg]

#10246: AIFF file with invalid ID3 chunk fails
-------------------------------------+-------------------------------------
             Reporter:  Mattias      |                     Type:  defect
  Wadman                             |
               Status:  new          |                 Priority:  normal
            Component:  avformat     |                  Version:  git-
                                     |  master
             Keywords:               |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 Summary of the bug:

 The aiff demuxer has support for skipping invalid ID3 chunks but if the
 invalidness is that the ID3 chunk is too short the file position might end
 up incorrect and then fail reading the next chunk.

 A possible solution is to allow seeking backwards in addition to currently
 only forward on invalid ID3.

 How to reproduce:
 {{{
 # master as of 2023-03-09
 $ ./ffmpeg_g --verison
 ffmpeg version N-109977-gaca7ef78cc Copyright (c) 2000-2023 the FFmpeg

 $ ./ffmpeg_g -v trace -i test.aiff -f null -
 ffmpeg version N-109977-gaca7ef78cc Copyright (c) 2000-2023 the FFmpeg
 developers
   built with Apple clang version 14.0.0 (clang-1400.0.29.202)
   configuration:
   libavutil      58.  3.100 / 58.  3.100
   libavcodec     60.  6.100 / 60.  6.100
   libavformat    60.  4.100 / 60.  4.100
   libavdevice    60.  2.100 / 60.  2.100
   libavfilter     9.  4.100 /  9.  4.100
   libswscale      7.  2.100 /  7.  2.100
   libswresample   4. 11.100 /  4. 11.100
 Splitting the commandline.
 Reading option '-v' ... matched as option 'v' (set logging level) with
 argument 'trace'.
 Reading option '-i' ... matched as input url with argument 'test.aiff'.
 Reading option '-f' ... matched as option 'f' (force format) with argument
 'null'.
 Reading option '-' ... matched as output url.
 Finished splitting the commandline.
 Parsing a group of options: global .
 Applying option v (set logging level) with argument trace.
 Successfully parsed a group of options.
 Parsing a group of options: input url test.aiff.
 Successfully parsed a group of options.
 Opening an input file: test.aiff.
 [NULL @ 0x7ff0d0a041c0] Opening 'test.aiff' for reading
 [file @ 0x7ff0d0a045c0] Setting default whitelist 'file,crypto,data'
 Probing aiff score:100 size:994
 [aiff @ 0x7ff0d0a041c0] Format aiff probed with size=2048 and score=100
 [aiff @ 0x7ff0d0a041c0] id3v2 ver:32 flags:00 len:9412
 [aiff @ 0x7ff0d0a041c0] ID3v2.32 tag skipped, cannot handle version
 [AVIOContext @ 0x7ff0d0a04740] Statistics: 994 bytes read, 0 seeks
 test.aiff: Input/output error
 }}}

 The originally file failing with this can't be shared due to licenses
 issues but the attached test.aiff recreates the issue. It was crated by
 doing:
 {{{
 ffmpeg -y -f lavfi -i sine -t 10ms test.wav
 sox test.wav test.aiff
 echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
 echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
 echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
 # then manually edited the FORM chunk size to account for the new chunks.
 }}}

 Possible fix is:
 {{{
 diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
 index 1cde12c193..fca7b06cb2 100644
 --- a/libavformat/aiffdec.c
 +++ b/libavformat/aiffdec.c
 @@ -274,7 +274,7 @@ static int aiff_read_header(AVFormatContext *s)
                      return ret;
                  }
              ff_id3v2_free_extra_meta(&id3v2_extra_meta);
 -            if (position + size > avio_tell(pb))
 +            if (position + size != avio_tell(pb))
                  avio_skip(pb, position + size - avio_tell(pb));
              break;
          case MKTAG('F', 'V', 'E', 'R'):     /* Version chunk */
 }}}
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/10246>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker