pdeljanov / Symphonia

Pure Rust multimedia format demuxing, tag reading, and audio decoding library
Mozilla Public License 2.0
2.4k stars 140 forks source link

Slice range panic in in layer3/mod.rs #112

Closed mullr closed 2 years ago

mullr commented 2 years ago

I wrote myself a little music player using symphonia, and I've seen panics on some files.

thread 'tokio-runtime-worker' panicked at 'range start index 588 out of range for slice of length 325', /home/mullr/.cargo/registry/src/github.com-1ecc6299db9ec823/symphonia-bundle-mp3-0.5.0/src/layer3/mod.rs:202:45

I can't share the input data here, but if there's some test program I should run over my data, I can do that.

pdeljanov commented 2 years ago

Hey @mullr,

I can probably fix this without needing the MP3, but if you are open to it, you could send me the file (or the part of the file that reproduces the error) to the email on my profile. I'd be curious to see what's wrong with it and to make sure my fix is the best possible. Thanks!

mullr commented 2 years ago

I just looked into it a little more deeply, and it turns out that it's actually an aac (m4a) file, but I hadn't included the aac feature (symphonia = { version = "0.5", features = ["mp3", "vorbis" ] }).

I'm using the defaults as much as I can:

        let mss = MediaSourceStream::new(Box::new(Cursor::new(data)), Default::default());
        let format_opts = FormatOptions {
            enable_gapless: true,
            ..Default::default()
        };
        let metadata_opts: MetadataOptions = Default::default();
        let hint = Hint::new();

Including AAC support fixes the panic. Still seems bad though.

pdeljanov commented 2 years ago

To clarify, is it MP3 audio inside a M4A container (fixed when isomp4 feature is enabled), or is it AAC audio in M4A (fixed when aac and isomp4 features are enabled)?

Can you provide me the output of this ffmpeg command: ffprobe -of json -show_streams </path/to/file>?

You are right though. Misdetection can happen, but the decoder should not panic. It's almost like an unintentional fuzz test.

mullr commented 2 years ago

I think it's aac in m4a.

ffprobe version 4.4-6ubuntu5 Copyright (c) 2007-2021 the FFmpeg developers
  built with gcc 11 (Ubuntu 11.2.0-7ubuntu1)
  configuration: --prefix=/usr --extra-version=6ubuntu5 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-nvenc --enable-chromaprint --enable-frei0r --enable-libx264 --enable-shared
  WARNING: library configuration mismatch
  avcodec     configuration: --prefix=/usr --extra-version=6ubuntu5 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-nvenc --enable-chromaprint --enable-frei0r --enable-libx264 --enable-shared --enable-version3 --disable-doc --disable-programs --enable-libaribb24 --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libtesseract --enable-libvo_amrwbenc --enable-libsmbclient
  libavutil      56. 70.100 / 56. 70.100
  libavcodec     58.134.100 / 58.134.100
  libavformat    58. 76.100 / 58. 76.100
  libavdevice    58. 13.100 / 58. 13.100
  libavfilter     7.110.100 /  7.110.100
  libswscale      5.  9.100 /  5.  9.100
  libswresample   3.  9.100 /  3.  9.100
  libpostproc    55.  9.100 / 55.  9.100
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x558386901ac0] stream 0, timescale not set
Input #0, mov,mp4,m4a,3gp,3g2,mj2, from '1-01 BABYMETAL - FUTURE METAL.m4a':
  Metadata:
    major_brand     : M4A 
    minor_version   : 0
    compatible_brands: isomM4A mp42
    title           : FUTURE METAL
    artist          : BABYMETAL
    composer        : 岡嶋かな多, Megumi Wada
    album           : METAL GALAXY
    genre           : Metal
    album_artist    : BABYMETAL
    disc            : 1/2
    date            : 2019-10-11
    encoder         : Lavf56.15.102
    MEDIA           : CD
    MusicBrainz Album Release Country: JP
    LANGUAGE        : jpn
    originalyear    : 2019
    ~length         : 2:06
    SCRIPT          : Jpan
    MusicBrainz Album Type: album
    Arranger        : MEGMETAL
    MusicBrainz Album Status: official
    Album Artist Credit: BABYMETAL
    Artist Credit   : BABYMETAL
    ARTISTS         : BABYMETAL
    originaldate    : 2019-10-08
    ORIGINAL YEAR   : 2019-10-11
    ASIN            : B07TLSVKLG
    CATALOGNUMBER   : TFCC-86687
    LYRICIST        : 岡嶋かな多
    BARCODE         : 4988061866871
    publisher       : TOY’S FACTORY
    ISRC            : JPTF01907101
    MusicBrainz Album Id: 084ecaba-6cc9-416e-b13f-02b629d6d593
    MusicBrainz Track Id: 23007dce-4fb2-4246-ae6e-5fb475f647b9
    MusicBrainz Release Track Id: 2364c71b-14da-4f2a-8ee8-abe2afff0eb3
    MusicBrainz Artist Id: 27e2997f-f7a1-4353-bcc4-57b9274fa9a4
    MusicBrainz Album Artist Id: 27e2997f-f7a1-4353-bcc4-57b9274fa9a4
    MusicBrainz Release Group Id: 721600e6-8be2-496e-868a-1af67772c3ce
    Acoustid Id     : e941908b-3638-4b94-9a51-4e2a4ad66f46
    Label           : TOY’S FACTORY
    MusicBrainz Album Comment: 通常盤 - Japan Complete Edition -
    Acoustid Fingerprint: AQADtLsSaUkiRXgOV65wDUkd5DnGJbiOHz1-5Wh2CZ-C7zCj0DhxTDlTClcOO2XRdMMdJD7iJxWaKcdxOsgDTeh1NDUFddPRH82J_MKFnsceFq60oU0SPEro4X4RaR_EENGTJ8QR6EV1uDeOM4nRvOgT_OhJ-BA74lKQV1hRXTl-Dg_q47hnwA_qI1l5hHEY4uvxCxd6pnhw9ei14NniI4cqZsmCPPieCbXwDYdzYaJFfPLxHc2DNhvmC7XhsxQ
    lyrics          : 
    grouping        : 
    sort_album_artist: BABYMETAL
    sort_artist     : BABYMETAL
    track           : FUTURE METAL
    sort_composer   : Okajima, Kanata, Wada, Megumi
  Duration: 00:02:05.85, start: 0.000000, bitrate: 329 kb/s
  Stream #0:0(und): Audio: aac (LC) (mp4a / 0x6134706D), 44100 Hz, stereo, fltp, 320 kb/s (default)
    Metadata:
      handler_name    : SoundHandler
      vendor_id       : [0][0][0][0]
  Stream #0:1: Video: mjpeg (Baseline), yuvj420p(pc, bt470bg/unknown/unknown), 500x500 [SAR 1:1 DAR 1:1], 90k tbr, 90k tbn, 90k tbc (attached pic)
{
    "streams": [
        {
            "index": 0,
            "codec_name": "aac",
            "codec_long_name": "AAC (Advanced Audio Coding)",
            "profile": "LC",
            "codec_type": "audio",
            "codec_tag_string": "mp4a",
            "codec_tag": "0x6134706d",
            "sample_fmt": "fltp",
            "sample_rate": "44100",
            "channels": 2,
            "channel_layout": "stereo",
            "bits_per_sample": 0,
            "r_frame_rate": "0/0",
            "avg_frame_rate": "0/0",
            "time_base": "1/44100",
            "start_pts": 0,
            "start_time": "0.000000",
            "duration_ts": 5550073,
            "duration": "125.851995",
            "bit_rate": "320058",
            "nb_frames": "5423",
            "disposition": {
                "default": 1,
                "dub": 0,
                "original": 0,
                "comment": 0,
                "lyrics": 0,
                "karaoke": 0,
                "forced": 0,
                "hearing_impaired": 0,
                "visual_impaired": 0,
                "clean_effects": 0,
                "attached_pic": 0,
                "timed_thumbnails": 0
            },
            "tags": {
                "language": "und",
                "handler_name": "SoundHandler",
                "vendor_id": "[0][0][0][0]"
            }
        },
        {
            "index": 1,
            "codec_name": "mjpeg",
            "codec_long_name": "Motion JPEG",
            "profile": "Baseline",
            "codec_type": "video",
            "codec_tag_string": "[0][0][0][0]",
            "codec_tag": "0x0000",
            "width": 500,
            "height": 500,
            "coded_width": 500,
            "coded_height": 500,
            "closed_captions": 0,
            "has_b_frames": 0,
            "sample_aspect_ratio": "1:1",
            "display_aspect_ratio": "1:1",
            "pix_fmt": "yuvj420p",
            "level": -99,
            "color_range": "pc",
            "color_space": "bt470bg",
            "chroma_location": "center",
            "refs": 1,
            "r_frame_rate": "90000/1",
            "avg_frame_rate": "0/0",
            "time_base": "1/90000",
            "start_pts": 0,
            "start_time": "0.000000",
            "duration_ts": 11326680,
            "duration": "125.852000",
            "bits_per_raw_sample": "8",
            "disposition": {
                "default": 0,
                "dub": 0,
                "original": 0,
                "comment": 0,
                "lyrics": 0,
                "karaoke": 0,
                "forced": 0,
                "hearing_impaired": 0,
                "visual_impaired": 0,
                "clean_effects": 0,
                "attached_pic": 1,
                "timed_thumbnails": 0
            }
        }
    ]
}
pdeljanov commented 2 years ago

Thanks, indeed that's an AAC file. I pushed a fix that should resolve the issue. Unfortunately, since this is a misdetection, the file is still going to be decoded as a MP3, but hopefully you'll just get a bunch of decode errors rather than a crash.