Skip to content

isomp4: reject lpcm audio sample entries below version 2 (fixes #560) - #566

Open
iliasabk wants to merge 1 commit into
pdeljanov:mainfrom
iliasabk:fix/isomp4-lpcm-sample-entry-version
Open

iliasabk wants to merge 1 commit into
pdeljanov:mainfrom
iliasabk:fix/isomp4-lpcm-sample-entry-version

Conversation

@iliasabk

Copy link
Copy Markdown

Issue

Fixes #560 — an MP4 whose audio sample entry type is lpcm with version 0 or 1 aborts the process while parsing the stsd atom.

Root cause

is_pcm_codec() (symphonia-format-isomp4/src/atoms/stsd.rs) returns true for AtomType::AudioSampleEntryLpcm at every sample entry version, because in version 2 the atom type for PCM data is always LPCM. However, pcm_codec_id() only maps the fixed PCM atom types and returns CODEC_ID_NULL_AUDIO for lpcm. The version 0 (:216) and version 1 (:249) arms then call bytes_per_pcm_sample(CODEC_ID_NULL_AUDIO), which has no arm for the null codec and falls through to unreachable!() at :381:

thread 'main' panicked at symphonia-format-isomp4/src/atoms/stsd.rs:381:14:
internal error: entered unreachable code

Reproduced end-to-end: a minimal MP4 (ftyp + moov/trak/mdia/minf/stbl/stsd with an lpcm sample entry at version 0) aborts IsoMp4Reader::try_new on current main.

Fix

The PCM format of an lpcm entry is only described by the version 2 extension fields, so an lpcm entry at version 0 or 1 is invalid. Both version arms now reject CODEC_ID_NULL_AUDIO with a decode error before reaching bytes_per_pcm_sample, matching the version 2 arm that already guards on the null codec id.

Verification

  • Unfixed: lpcm v0 and v1 sample entries panic at stsd.rs:381 (unreachable!()). Fixed: both return DecodeError("isomp4: lpcm audio sample entry must be version 2").
  • New tests in stsd.rs: lpcm v0/v1 rejected, lpcm v2 accepted, sowt v0 accepted (fixed-codec PCM atom types still parse).
  • cargo test -p symphonia-format-isomp4: 4 passed, 0 failed.
  • cargo clippy -p symphonia-format-isomp4 --all-targets: clean; cargo check --all-targets: clean.

Disclosure: this PR was prepared with AI assistance (Devin) and verified locally before submission.

…).

An MP4 whose audio sample entry type is lpcm with version 0 or 1 aborted
the process while parsing the stsd atom. is_pcm_codec() returns true for
the lpcm atom type at every version, but pcm_codec_id() only maps fixed
PCM atom types and returns CODEC_ID_NULL_AUDIO for lpcm. The version 0
and 1 paths then called bytes_per_pcm_sample() with the null codec id,
which fell through to unreachable!().

The PCM format of an lpcm entry is only described by the version 2
extension fields, so an lpcm entry at version 0 or 1 is invalid. The
version 0 and 1 arms now reject a null codec id with a decode error,
matching the version 2 arm that already guards on it.

Fixes pdeljanov#560.
Comment on lines +220 to +222
if entry.codec_id == CODEC_ID_NULL_AUDIO {
return decode_error("isomp4: lpcm audio sample entry must be version 2");
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean guard matching the v2 CODEC_ID_NULL_AUDIO check below.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

isomp4: unreachable!() panic parsing an lpcm audio sample entry (version 0/1)

2 participants