Justin Ruggles <[email protected]> added the comment:
The issue is that the SSND chunk does not have to be the last chunk in the AIFF
file, but the AIFF demuxer reads audio data until the end of the file. The
attached patch determines the audio data size so that aiff_read_packet() does
not return data past the end of the SSND chunk.
----------
nosy: +jbr
substatus: open -> analyzed
_____________________________________________________
FFmpeg issue tracker <[email protected]>
<https://roundup.ffmpeg.org/roundup/ffmpeg/issue1455>
_____________________________________________________
diff --git a/libavformat/aiff.c b/libavformat/aiff.c
index 570e05d..66088da 100644
--- a/libavformat/aiff.c
+++ b/libavformat/aiff.c
@@ -46,6 +46,12 @@ static const AVCodecTag codec_aiff_tags[] = {
#define AIFF 0
#define AIFF_C_VERSION1 0xA2805140
+typedef struct {
+ int64_t data_offset;
+ int64_t data_size;
+ int max_packet_size;
+} AIFFInputContext;
+
static enum CodecID aiff_codec_get_id(int bps)
{
if (bps <= 8)
@@ -314,6 +320,7 @@ static int aiff_read_header(AVFormatContext *s,
unsigned version = AIFF_C_VERSION1;
ByteIOContext *pb = s->pb;
AVStream * st;
+ AIFFInputContext *ctx = s->priv_data;
/* check FORM header */
filesize = get_tag(pb, &tag);
@@ -368,7 +375,9 @@ static int aiff_read_header(AVFormatContext *s,
case MKTAG('S', 'S', 'N', 'D'): /* Sampled sound chunk */
offset = get_be32(pb); /* Offset of sound data */
get_be32(pb); /* BlockSize... don't care */
+ ctx->data_size = size - (8 + offset);
offset += url_ftell(pb); /* Compute absolute data offset */
+ ctx->data_offset = offset;
if (st->codec->block_align) /* Assume COMM already parsed */
goto got_sound;
if (url_is_streamed(pb)) {
@@ -420,10 +429,23 @@ static int aiff_read_packet(AVFormatContext *s,
AVPacket *pkt)
{
AVStream *st = s->streams[0];
+ AIFFInputContext *ctx = s->priv_data;
+ int64_t max_size, pos;
int res;
+ /* calculate size of remaining data */
+ pos = url_ftell(s->pb);
+ if (pos < ctx->data_offset) {
+ url_fseek(s->pb, ctx->data_offset, SEEK_SET);
+ pos = ctx->data_offset;
+ }
+ max_size = ctx->data_size - (pos - ctx->data_offset);
+ if (max_size <= 0)
+ return AVERROR_EOF;
+
/* Now for that packet */
- res = av_get_packet(s->pb, pkt, (MAX_SIZE / st->codec->block_align) * st->codec->block_align);
+ max_size = FFMIN(max_size, (MAX_SIZE / st->codec->block_align) * st->codec->block_align);
+ res = av_get_packet(s->pb, pkt, max_size);
if (res < 0)
return res;
@@ -436,7 +458,7 @@ static int aiff_read_packet(AVFormatContext *s,
AVInputFormat aiff_demuxer = {
"aiff",
NULL_IF_CONFIG_SMALL("Audio IFF"),
- 0,
+ sizeof(AIFFInputContext),
aiff_probe,
aiff_read_header,
aiff_read_packet,