AIFF file with invalid ID3 chunk fails

[Mattias Wadman]

Summary of the bug:

The aiff demuxer has support for skipping invalid ID3 chunks but if the invalidness is that the ID3 chunk is too short the file position might end up incorrect and then fail reading the next chunk.

A possible solution is to allow seeking backwards in addition to currently only forward on invalid ID3.

How to reproduce:

# master as of 2023-03-09
$ ./ffmpeg_g --verison
ffmpeg version N-109977-gaca7ef78cc Copyright (c) 2000-2023 the FFmpeg 

$ ./ffmpeg_g -v trace -i test.aiff -f null -
ffmpeg version N-109977-gaca7ef78cc Copyright (c) 2000-2023 the FFmpeg developers
  built with Apple clang version 14.0.0 (clang-1400.0.29.202)
  configuration:
  libavutil      58.  3.100 / 58.  3.100
  libavcodec     60.  6.100 / 60.  6.100
  libavformat    60.  4.100 / 60.  4.100
  libavdevice    60.  2.100 / 60.  2.100
  libavfilter     9.  4.100 /  9.  4.100
  libswscale      7.  2.100 /  7.  2.100
  libswresample   4. 11.100 /  4. 11.100
Splitting the commandline.
Reading option '-v' ... matched as option 'v' (set logging level) with argument 'trace'.
Reading option '-i' ... matched as input url with argument 'test.aiff'.
Reading option '-f' ... matched as option 'f' (force format) with argument 'null'.
Reading option '-' ... matched as output url.
Finished splitting the commandline.
Parsing a group of options: global .
Applying option v (set logging level) with argument trace.
Successfully parsed a group of options.
Parsing a group of options: input url test.aiff.
Successfully parsed a group of options.
Opening an input file: test.aiff.
[NULL @ 0x7ff0d0a041c0] Opening 'test.aiff' for reading
[file @ 0x7ff0d0a045c0] Setting default whitelist 'file,crypto,data'
Probing aiff score:100 size:994
[aiff @ 0x7ff0d0a041c0] Format aiff probed with size=2048 and score=100
[aiff @ 0x7ff0d0a041c0] id3v2 ver:32 flags:00 len:9412
[aiff @ 0x7ff0d0a041c0] ID3v2.32 tag skipped, cannot handle version
[AVIOContext @ 0x7ff0d0a04740] Statistics: 994 bytes read, 0 seeks
test.aiff: Input/output error

The originally file failing with this can't be shared due to licenses issues but the attached test.aiff recreates the issue. It was crated by doing:

ffmpeg -y -f lavfi -i sine -t 10ms test.wav
sox test.wav test.aiff
echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
echo -ne "ID3 \x00\0x00\x00\x00" >> test.aiff
# then manually edited the FORM chunk size to account for the new chunks.

Possible fix is:

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 1cde12c193..fca7b06cb2 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -274,7 +274,7 @@ static int aiff_read_header(AVFormatContext *s)
                     return ret;
                 }
             ff_id3v2_free_extra_meta(&id3v2_extra_meta);
-            if (position + size > avio_tell(pb))
+            if (position + size != avio_tell(pb))
                 avio_skip(pb, position + size - avio_tell(pb));
             break;
         case MKTAG('F', 'V', 'E', 'R'):     /* Version chunk */

[Mattias Wadman]

Also sox seems to have no issue reading test.aiff