Commit Graph

34 Commits

Author SHA1 Message Date
Lynne
274064a5c7 aacdec_usac: use RefStruct to track unfinished extension buffers
Extensions in AAC USAC can be stored across multiple frames (mainly to keep CBR compliance).
This means that we need to reallocate a buffer when new data is received, accumulate the bitstream data,
and so on until the end of extension flag is signalled and the extension can be decoded.

This is made more complicated by the way in which the AAC channel layout switching is performed.
After decades of evolution, our AAC decoder evolved to double-buffer its entire configuration.
All changes are buffered, verified, and applied, on a per-frame basis if required, in often
random order.

Since we allocate the extension data on heap, this means that if configuration is applied,
in order to avoid double-freeing, we have to keep track of what we've allocated.

It should be noted that extensions which are spread in multiple frames are generally rare,
so an optimization to introduce av_refstruct_realloc() wouldn't generally be useful across the codebase.
Therefore, a copy is good enough for now.

Thanks to Michael Niedermayer for additional fixing.

Fixes: double free
Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit c05fc27dd3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:34 +02:00
Michael Niedermayer
10c774906c avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame
Fixes: null pointer dereference
Fixes: crash_test.mp4

Found-by: Intel PSIRT
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fcf180d9ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:33 +02:00
Michael Niedermayer
0e5b6a7156 avcodec/aac/aacdec: Clear SFO on error
types and SFO become confused for a USAC stream

Fixes: out of array access
Fixes: 383854203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4996677847547904.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d1be369af6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-26 01:26:33 +01:00
Michael Niedermayer
a82139d0e6 avcodec/aac/aacdec: Free channel layout
Fixes: 371445194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5981081124274176
Fixes: memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae81beb351)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-01-03 18:28:48 +01:00
James Almer
1b5bdce86a avcodec/aac/aacdec: set keyframe flag in output frames
Don't depend on the generic code setting this.
This is in preparation for a following change.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit faea08b722)
2024-12-01 12:53:33 -03:00
Michael Niedermayer
36924fa306 avcodec/aac/aacdec: use correct index in deallocation
Fixes: memleak
Fixes: 71084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5857751899635712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-09-24 15:37:16 +02:00
Lynne
b1b69ccbc0 aacdec: set ac->output_elements upon channel element free
The issue is that ac->output_elements is populated from
ac->che, which may be freed, leaving dangling pointers in this
list.

Should fix clusterfuzz.
2024-07-24 00:32:38 +02:00
Lynne
50e5b78b79 aac: expose ff_aac_sample_rate_idx() in aac.h
The rate index is a value important to both encoders and decoders.
USAC needs it as well, so put it into the shared main header.
2024-06-21 10:50:20 +02:00
Lynne
c2d459cb51 aacdec_usac: fix stereo alpha values for transients
Typo.
Also added comments and fixed the branch underneath.
2024-06-08 00:22:40 +02:00
Lynne
8a2fe8a5b9 mpeg4audio: rename AOT_USAC_NOSBR to AOT_USAC
The issue is that AOT 45 isn't defined anywhere, and looking at the git
blame, it seems to have sprung up through a reordering of the enum,
and adding a hole.

The spec does not define an explicit AOT for SBR and no SBR, and only
uses AOT 42 (previously AOT_USAC_NOSBR), so just rename AOT_USAC to
it and replace its use everywhere.
2024-06-08 00:22:31 +02:00
Lynne
eee5fa0808 aacdec: add a decoder for AAC USAC (xHE-AAC)
This commit adds a decoder for the frequency-domain part of USAC.

What works:
 - Mono
 - Stereo (no prediction)
 - Stereo (mid/side coding)
 - Stereo (complex prediction)

What's left:
 - SBR
 - Speech coding

Known issues:
 - Desync with certain sequences
 - Preroll crossover missing (shouldn't matter, bitrate adaptation only)
2024-06-02 18:34:45 +02:00
Lynne
0513c5cd25 aacdec_dsp: implement 768-point transform and windowing
Required for USAC
2024-06-02 18:34:44 +02:00
Lynne
f8543f3763 aacdec: expose decode_tns
USAC has the same syntax, with one minor change we can check for.
2024-06-02 18:34:43 +02:00
Lynne
0f2303f629 aacdec: expose channel layout related functions 2024-06-02 18:34:43 +02:00
Lynne
39b8d84b53 aacdec: move from scalefactor ranged arrays to flat arrays
AAC uses an unconventional system to send scalefactors
(the volume+quantization value for each band).
Each window is split into either 1 or 8 blocks (long vs short),
and transformed separately from one another, with the coefficients
for each being also completely independent. The scalefactors
slightly increase from 64 (long) to 128 (short) to accomodate
better per-block-per-band volume for each window.

To reduce overhead, the codec signals scalefactor sizes in an obtuse way,
where each group's scalefactor types are sent via a variable length decoding,
with a range.
But our decoder was written in a way where those ranges were carried through
the entire decoder, and to actually read them you had to use the range.

Instead of having a dedicated array with a range for each scalefactor,
just let the decoder directly index each scalefactor.

This also switches the form of quantized scalefactors to the format
the spec uses, where for intensity stereo and regular, scalefactors
are stored in a scalefactor - 100 form, rather than as-is.

USAC gets rid of the complex scalefactor handling. This commit permits
for code sharing between both.
2024-06-02 18:34:43 +02:00
Andreas Rheinhardt
2eab5a1f54 avcodec/aac/aacdec: Fix linking errors with only one decoder enabled
This is achieved by using function pointers for AAC SBR functions.
This unfortunately necessitated to use void* in
ff_aac_sbr_apply(_fixed).
Fixes ticket #10999.

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-07 12:33:50 +02:00
Andreas Rheinhardt
8762aa4d62 avcodec/aac/aacdec: Move init functions to aacdec_fixed/float
This allows to merge it with AACDecDSP.init and remove the latter
(it is called only once anyway); it also allows to make
the fixed/float AACDecDSP and AACDecProc implementations internal
to aacdec_fixed/float.c (which also fixes a violation of our
naming conventions). And it some linker errors when either decoder
is disabled.

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-07 00:01:39 +02:00
Andreas Rheinhardt
0fc3d8e4d6 avcodec/aac/aacdec: Avoid compiling latm decoder if disabled
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-07 00:00:04 +02:00
Andreas Rheinhardt
d4fb110f5c avcodec/aac/aacdec: Mark flush as cold
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-06 23:59:43 +02:00
Andreas Rheinhardt
41ea317ced avcodec/aac/aacdec: Avoid branch to set sample_fmt
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-06 23:58:58 +02:00
Andreas Rheinhardt
ef16882e8f avcodec/aac/aacdec: Move channel number check out of init_dsp()
Also move initializing random_state.

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-06 23:58:31 +02:00
Andreas Rheinhardt
e4e9144a5c avcodec/aac/aacdec: Remove unnecessary ff_thread_once()
ff_aacdec_common_init_once() already uses its own AVOnce.

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-06 23:58:08 +02:00
Andreas Rheinhardt
44474dd7b9 avcodec/aacsbr: Fix type mismatch
ff_aac_sbr_apply() and ff_aac_sbr_apply_fixed() still used
pointers to INTFLOAT which is float or int depending upon
whether USE_FIXED is set or not; in particular, according
to these declarations both functions have the same type.
But that is wrong and given that aacdec.c sets USE_FIXED,
it sees the wrong type for ff_aac_sbr_apply().
This leads to a -Wlto-type-mismatch warning when using lto [1].
Fix this by avoiding INTFLOAT in aacsbr.h (which also means
that aac_defines.h need not be included there any more).

[1]: https://fate.ffmpeg.org/log.cgi?slot=x86_64-archlinux-gcc-lto&time=20240506022217&log=compile

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-05-06 23:57:41 +02:00
Lynne
3390693bfb aacdec: avoid generating unused code when either implementation is disabled
Minor optimization to remove extra branches.
We need to include the header for xHE anyway, which is float-only.
2024-04-27 11:12:12 +02:00
Lynne
e3650886c7 aacdec: initialize float/fixed SBR tables only when either is needed 2024-04-23 08:31:41 +02:00
Lynne
ae7c6cc17d aac: move aacdec.c to aac/aacdec.c 2024-04-23 08:31:40 +02:00
Lynne
551ce16b59 aacdec: move aacdec.h into libavcodec/aac 2024-04-23 08:31:40 +02:00
Lynne
2f90d83981 aacdec: move fixed/float DSP initialization to templated init functions 2024-04-23 08:31:38 +02:00
Lynne
41ae2b03a5 aacdec: move spectrum decode and dequantization to a new file 2024-04-23 08:31:35 +02:00
Lynne
a309aa4127 aacdec: duplicate table initialization
Preparation to move all table init and support windowing functions.
2024-04-23 08:31:34 +02:00
Lynne
a6295586f5 aacdec: template scalefactor dequantization separately 2024-04-23 08:31:32 +02:00
Andreas Rheinhardt
9de66fd449 avcodec/aacdec_template: Deduplicate common part of aac_decode_init()
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-04-23 08:31:30 +02:00
Andreas Rheinhardt
980a55fb46 avcodec/aacdec_template: Deduplicate AVClass+AVOptions
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-04-23 08:31:29 +02:00
Andreas Rheinhardt
e3693c6f56 avcodec/aacdec_template: Deduplicate aac_decode_close()
This is possible now that both AAC decoders share the same
context.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-04-23 08:31:29 +02:00