PR #22518 opened by Jun Zhao (mypopydev) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22518 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22518.patch
The VVC probe only checked forbidden_zero_bit but not nuh_reserved_zero_bit or nuh_layer_id range, both required by the spec. This allowed certain MP3 files to be misdetected as VVC streams because their frame data coincidentally contained 00 00 01 start code patterns that looked like valid NAL units. Add checks for nuh_reserved_zero_bit (must be 0) and nuh_layer_id (must be <= 55) to match the spec, consistent with how hevc_probe validates its NAL unit headers. Signed-off-by: Jun Zhao <[email protected]> >From c8d8993c059cff65d4e2ca1e7a86302de24b1957 Mon Sep 17 00:00:00 2001 From: Jun Zhao <[email protected]> Date: Mon, 16 Mar 2026 15:30:32 +0800 Subject: [PATCH] lavf/vvcdec: fix false-positive VVC detection of MP3 files The VVC probe only checked forbidden_zero_bit but not nuh_reserved_zero_bit or nuh_layer_id range, both required by the spec. This allowed certain MP3 files to be misdetected as VVC streams because their frame data coincidentally contained 00 00 01 start code patterns that looked like valid NAL units. Add checks for nuh_reserved_zero_bit (must be 0) and nuh_layer_id (must be <= 55) to match the spec, consistent with how hevc_probe validates its NAL unit headers. Signed-off-by: Jun Zhao <[email protected]> --- libavformat/vvcdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/vvcdec.c b/libavformat/vvcdec.c index 1bfa1b5d69..0c997b72cc 100644 --- a/libavformat/vvcdec.c +++ b/libavformat/vvcdec.c @@ -53,7 +53,10 @@ static int vvc_probe(const AVProbeData *p) uint8_t nal2 = p->buf[i + 1]; int type = (nal2 & 0xF8) >> 3; - if (code & 0x80) // forbidden_zero_bit + if (code & 0xC0) // forbidden_zero_bit or nuh_reserved_zero_bit + return 0; + + if ((code & 0x3F) > 55) // nuh_layer_id must be <= 55 return 0; if (!check_temporal_id(nal2 & 0x7, type)) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
