[FFmpeg-devel] [PATCH] avcodec/flac: check frame header crc only if requested

[Michael Niedermayer]

On Thu, Dec 08, 2016 at 12:33:56AM -0300, James Almer wrote:
> It's more consistent with other similar checks in the decoder, and should
> help with fuzzing.
> 
> Signed-off-by: James Almer <jamrial at gmail.com>
> ---
> I could also add an AV_EF_EXPLODE check before aborting, but i figured
> that with a frame header crc failure it's pretty much guaranteed the 
> file will be unplayable.
> 
>  libavcodec/flac.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

FFmpeg decoders primary usecase is to decode for human consumption
for this producing the best quality possible and doing so fast is
the goal.
The default thus should be to do checks that improve quality
its probably better if fuzzers disable these checks instead of the
"default being changed"

treating damaged headers as if they are valid will lead to bad
quality at the location where this occurs.
also this function is used by the parser and i _think_ the code expects
that it always checks the crc.
also for detecting the parameters of a stream, its important to use
a undamaged header otherwise the parameters could be more often wrong.

whatever default is used for err_recognition some checks like this
one should be enabled in that case
actually i thought we have a non zero default but it seems 0 in
libavcodec, i think this is bad as well.
With a 0 default nothing can be enabled by default (if the mask is all
positive with 0 being all disabled)

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 1
"Used only once"    - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20161208/9db29098/attachment.sig>