From c49f6bec20cc14637360c7ad134e3b30f1d69249 Mon Sep 17 00:00:00 2001 From: Jun Zhao Date: Mon, 16 Mar 2026 15:30:32 +0800 Subject: [PATCH] lavf/vvcdec: fix false-positive VVC detection of MP3 files The VVC probe only checked forbidden_zero_bit but not nuh_layer_id range in the NAL unit header. This allowed certain MP3 files to be misdetected as VVC streams because their frame data coincidentally contained 00 00 01 start code patterns that looked like valid NAL units. Add a check for nuh_layer_id (must be <= 55). The existing check_temporal_id() already validates nuh_temporal_id_plus1 is in [1, 7]. Together these two checks reject the bogus NAL units produced by MP3 frame data. Note: nuh_reserved_zero_bit is intentionally not checked here, as it is reserved for future use by the spec and may become non-zero in a later revision. Signed-off-by: Jun Zhao --- libavformat/vvcdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/vvcdec.c b/libavformat/vvcdec.c index 1bfa1b5d69..dbd9eac388 100644 --- a/libavformat/vvcdec.c +++ b/libavformat/vvcdec.c @@ -56,6 +56,9 @@ static int vvc_probe(const AVProbeData *p) if (code & 0x80) // forbidden_zero_bit return 0; + if ((code & 0x3F) > 55) // nuh_layer_id must be in [0, 55] + return 0; + if (!check_temporal_id(nal2 & 0x7, type)) return 0;