Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

error out of bounds #354

Open
daiyam opened this issue Feb 10, 2025 · 6 comments
Open

error out of bounds #354

daiyam opened this issue Feb 10, 2025 · 6 comments

Comments

@daiyam
Copy link

daiyam commented Feb 10, 2025

Hello,

I have a mp3 album which generates the error out of bounds.
Here the log that I get:

[] INFO extension: Some("mp3")
[] INFO probing Hint { extension: Some("mp3"), mime_type: None }
[] INFO opts FormatOptions { prebuild_seek_index: false, seek_index_fill_rate: 20, enable_gapless: true }
[] INFO meta MetadataOptions { limit_metadata_bytes: Maximum(50), limit_visual_bytes: Maximum(0) }
[src/probe.rs:279] INFO symphonia_core::probe:found the format marker [49, 44, 33] @ 0+2 bytes.
[src/probe.rs:279] INFO symphonia_core::probe:found the format marker [49, 44, 33] @ 164568+2 bytes.
[] ERROR out of bounds
@daiyam daiyam mentioned this issue Feb 10, 2025
Merged
@daiyam
Copy link
Author

daiyam commented Feb 15, 2025

  • symphonia-check
❯ ./symphonia-check "/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3"
Input Path: /Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3


Test Results
=================================================

  Failed/Total Packets:            0/           0
  Failed/Total Samples:            0/           0

  Absolute Maximum Sample Delta:       0.00000000

PASS
  • symphonia-play
❯ ./symphonia-play "/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3"
 ERROR symphonia_play > out of bounds
  • ffmpeg
❯ ffmpeg -v debug -i "/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3" -f null -
ffmpeg version 7.1 Copyright (c) 2000-2024 the FFmpeg developers
  built with clang version 16.0.6
  configuration: --disable-static --prefix=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1 --target_os=darwin --arch=aarch64 --pkg-config=pkg-config --enable-gpl --enable-version3 --disable-nonfree --disable-static --enable-shared --enable-pic --disable-thumb --disable-small --enable-runtime-cpudetect --disable-gray --enable-swscale-alpha --enable-hardcoded-tables --enable-safe-bitstream-reader --enable-pthreads --disable-w32threads --disable-os2threads --enable-network --enable-pixelutils --datadir=/nix/store/690imyqww4ivqxykncfkvk36brrcsrb8-ffmpeg-headless-7.1-data/share/ffmpeg --enable-ffmpeg --disable-ffplay --enable-ffprobe --bindir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1-bin/bin --enable-avcodec --enable-avdevice --enable-avfilter --enable-avformat --enable-avutil --enable-postproc --enable-swresample --enable-swscale --libdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1-lib/lib --incdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1-dev/include --enable-doc --enable-htmlpages --enable-manpages --mandir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1-man/share/man --enable-podpages --enable-txtpages --docdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-ffmpeg-headless-7.1-doc/share/doc/ffmpeg --disable-alsa --disable-amf --enable-libaom --enable-appkit --disable-libaribb24 --disable-libaribcaption --enable-libass --enable-audiotoolbox --enable-avfoundation --disable-avisynth --disable-libbluray --disable-libbs2b --enable-bzlib --disable-libcaca --disable-libcdio --enable-libcelt --disable-chromaprint --disable-libcodec2 --enable-coreimage --disable-cuda --disable-cuda-llvm --disable-cuda-nvcc --disable-cuvid --enable-libdav1d --disable-libdc1394 --disable-libdrm --disable-libdvdnav --disable-libdvdread --disable-libfdk-aac --disable-ffnvcodec --disable-libflite --enable-fontconfig --enable-libfontconfig --enable-libfreetype --disable-frei0r --disable-libfribidi --disable-libgme --enable-gnutls --disable-libgsm --enable-libharfbuzz --enable-iconv --disable-libilbc --disable-libjack --disable-libjxl --disable-ladspa --disable-lcms2 --enable-lzma --disable-metal --disable-libmfx --disable-libmodplug --enable-libmp3lame --disable-libmysofa --disable-libnpp --disable-nvdec --disable-nvenc --disable-openal --disable-opencl --disable-libopencore-amrnb --disable-libopencore-amrwb --disable-opengl --disable-libopenh264 --enable-libopenjpeg --disable-libopenmpt --enable-libopus --disable-libplacebo --disable-libpulse --disable-libqrencode --disable-libquirc --disable-librav1e --disable-librtmp --disable-librubberband --disable-libsmbclient --disable-sdl2 --disable-libshaderc --disable-libshine --disable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --disable-librsvg --disable-libsvtav1 --disable-libtensorflow --enable-libtheora --disable-libtwolame --disable-libv4l2 --disable-v4l2-m2m --disable-vaapi --disable-vdpau --disable-libvpl --enable-videotoolbox --enable-libvidstab --disable-libvmaf --disable-libvo-amrwbenc --enable-libvorbis --enable-libvpx --disable-vulkan --enable-libwebp --enable-libx264 --enable-libx265 --disable-libxavs --disable-libxcb --disable-libxcb-shape --disable-libxcb-shm --disable-libxcb-xfixes --disable-libxevd --disable-libxeve --disable-xlib --disable-libxml2 --enable-libxvid --enable-libzimg --enable-zlib --disable-libzmq --disable-libzvbi --disable-debug --enable-optimizations --disable-extra-warnings --disable-stripping --cc=clang --cxx=clang++
  libavutil      59. 39.100 / 59. 39.100
  libavcodec     61. 19.100 / 61. 19.100
  libavformat    61.  7.100 / 61.  7.100
  libavdevice    61.  3.100 / 61.  3.100
  libavfilter    10.  4.100 / 10.  4.100
  libswscale      8.  3.100 /  8.  3.100
  libswresample   5.  3.100 /  5.  3.100
  libpostproc    58.  3.100 / 58.  3.100
Splitting the commandline.
Reading option '-v' ... matched as option 'v' (set logging level) with argument 'debug'.
Reading option '-i' ... matched as input url with argument '/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3'.
Reading option '-f' ... matched as option 'f' (force container format (auto-detected otherwise)) with argument 'null'.
Reading option '-' ... matched as output url.
Finished splitting the commandline.
Parsing a group of options: global .
Applying option v (set logging level) with argument debug.
Successfully parsed a group of options.
Parsing a group of options: input url /Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3.
Successfully parsed a group of options.
Opening an input file: /Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3.
[AVFormatContext @ 0x15a0040f0] Opening '/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3' for reading
[file @ 0x15a004520] Setting default whitelist 'file,crypto,data'
[mp3 @ 0x15a0040f0] Format mp3 probed with size=524288 and score=50
id3v2 ver:4 flags:00 len:164580
id3v2 ver:2 flags:00 len:2104
[mp3 @ 0x15a0040f0] Skipping 0 bytes of junk at 166704.
[mp3 @ 0x15a0040f0] Before avformat_find_stream_info() pos: 166704 bytes read:524288 seeks:0 nb_streams:2
[mp3 @ 0x15a0040f0] All info found
[mp3 @ 0x15a0040f0] Estimating duration from bitrate, this may be inaccurate
[mp3 @ 0x15a0040f0] After avformat_find_stream_info() pos: 198448 bytes read:524288 seeks:0 frames:51
Input #0, mp3, from '/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3':
  Metadata:
    album           : Rie Fu
    title           : Waratte, Megumi no Moto he
    date            : 2005
    track           : 01/14
    artist          : Rie Fu
    iTunNORM        :  00000A55 0000092A 0000240A 00001F20 0001FBE7 0001FBE7 00008000 00008000 0001FBE7 0001FBE7
  Duration: 00:03:13.52, start: 0.000000, bitrate: 198 kb/s
  Stream #0:0, 50, 1/14112000: Audio: mp3 (mp3float), 44100 Hz, stereo, fltp, 192 kb/s
  Stream #0:1, 1, 1/90000: Video: png, 1 reference frame, rgb24(pc, gbr/unknown/unknown), 316x320 [SAR 2835:2835 DAR 79:80], 0/1, 90k tbr, 90k tbn (attached pic)
      Metadata:
        comment         : Other
Successfully opened the file.
Parsing a group of options: output url -.
Applying option f (force container format (auto-detected otherwise)) with argument null.
Successfully parsed a group of options.
Opening an output file: -.
[out#0/null @ 0x159705380] No explicit maps, mapping streams automatically...
[vost#0:0/wrapped_avframe @ 0x159710a80] Created video stream from input stream 0:1
[aost#0:1/pcm_s16le @ 0x149606a10] Created audio stream from input stream 0:0
Successfully opened the file.
Stream mapping:
  Stream #0:1 -> #0:0 (png (native) -> wrapped_avframe (native))
  Stream #0:0 -> #0:1 (mp3 (mp3float) -> pcm_s16le (native))
[vost#0:0/wrapped_avframe @ 0x159710a80] Starting thread...
[aost#0:1/pcm_s16le @ 0x149606a10] Starting thread...
[vf#0:0 @ 0x159711440] Starting thread...
[af#0:1 @ 0x1496076e0] Starting thread...
[vist#0:1/png @ 0x159704cf0] [dec:png @ 0x1496042c0] Starting thread...
[aist#0:0/mp3 @ 0x15970fe90] [dec:mp3float @ 0x149607c40] Starting thread...
[in#0/mp3 @ 0x159704310] Starting thread...
Press [q] to stop, [?] for help
detected 10 logical cores
[graph_-1_in_0:0 @ 0x14960a0b0] Setting 'time_base' to value '1/44100'
[graph_-1_in_0:0 @ 0x14960a0b0] Setting 'sample_rate' to value '44100'
[graph_-1_in_0:0 @ 0x14960a0b0] Setting 'sample_fmt' to value 'fltp'
[graph_-1_in_0:0 @ 0x14960a0b0] Setting 'channel_layout' to value 'stereo'
[graph_-1_in_0:0 @ 0x14960a0b0] tb:1/44100 samplefmt:fltp samplerate:44100 chlayout:stereo
[format_out_#0:1 @ 0x14960a5b0] Setting 'sample_fmts' to value 's16'
[format_out_#0:1 @ 0x14960a5b0] auto-inserting filter 'auto_aresample_0' between the filter 'Parsed_anull_0' and the filter 'format_out_#0:1'
[AVFilterGraph @ 0x15962dd90] query_formats: 4 queried, 4 merged, 6 already done, 0 delayed
[auto_aresample_0 @ 0x15a004830] [SWR @ 0x120008000] Using fltp internally between filters
[auto_aresample_0 @ 0x15a004830] ch:2 chl:stereo fmt:fltp r:44100Hz -> ch:2 chl:stereo fmt:s16 r:44100Hz
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'video_size' to value '316x320'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'pix_fmt' to value '2'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'time_base' to value '1/90000'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'pixel_aspect' to value '2835/2835'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'colorspace' to value '0'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'range' to value '2'
[graph -1 input from stream 0:1 @ 0x14960b450] Setting 'frame_rate' to value '90000/1'
[graph -1 input from stream 0:1 @ 0x14960b450] w:316 h:320 pixfmt:rgb24 tb:1/90000 fr:90000/1 sar:2835/2835 csp:gbr range:pc
[AVFilterGraph @ 0x14960aa10] query_formats: 3 queried, 6 merged, 0 already done, 0 delayed
[graph -1 input from stream 0:1 @ 0x14960b450] video frame properties congruent with link at pts_time: 0
Output #0, null, to 'pipe:':
  Metadata:
    album           : Rie Fu
    title           : Waratte, Megumi no Moto he
    date            : 2005
    track           : 01/14
    artist          : Rie Fu
    iTunNORM        :  00000A55 0000092A 0000240A 00001F20 0001FBE7 0001FBE7 00008000 00008000 0001FBE7 0001FBE7
    encoder         : Lavf61.7.100
  Stream #0:0, 0, 1/90000: Video: wrapped_avframe, 1 reference frame, rgb24(pc, gbr/unknown/unknown, progressive), 316x320 [SAR 2835:2835 DAR 79:80], 0/1, q=2-31, 200 kb/s, 90k fps, 90k tbn (attached pic)
      Metadata:
        comment         : Other
        encoder         : Lavc61.19.100 wrapped_avframe
  Stream #0:1, 0, 1/44100: Audio: pcm_s16le, 44100 Hz, stereo, s16, 1411 kb/s
      Metadata:
        encoder         : Lavc61.19.100 pcm_s16le
[out#0/null @ 0x159705380] Starting thread...
[in#0/mp3 @ 0x159704310] EOF while reading input
[in#0/mp3 @ 0x159704310] Terminating thread with return code 0 (success)
[vist#0:1/png @ 0x159704cf0] [dec:png @ 0x1496042c0] Decoder thread received EOF packet
[vist#0:1/png @ 0x159704cf0] [dec:png @ 0x1496042c0] Decoder returned EOF, finishing
[vist#0:1/png @ 0x159704cf0] [dec:png @ 0x1496042c0] Terminating thread with return code 0 (success)
[aist#0:0/mp3 @ 0x15970fe90] [dec:mp3float @ 0x149607c40] Decoder thread received EOF packet
[aist#0:0/mp3 @ 0x15970fe90] [dec:mp3float @ 0x149607c40] Decoder returned EOF, finishing
[aist#0:0/mp3 @ 0x15970fe90] [dec:mp3float @ 0x149607c40] Terminating thread with return code 0 (success)
[out_#0:1 @ 0x14960a250] EOF on sink link out_#0:1:default.
[af#0:1 @ 0x1496076e0] Filtergraph returned EOF, finishing
[af#0:1 @ 0x1496076e0] All consumers returned EOF
[out_#0:0 @ 0x14960bb90] EOF on sink link out_#0:0:default.
[vf#0:0 @ 0x159711440] Filtergraph returned EOF, finishing
[vf#0:0 @ 0x159711440] All consumers returned EOF
[aost#0:1/pcm_s16le @ 0x149606a10] Encoder thread received EOF
[aost#0:1/pcm_s16le @ 0x149606a10] Terminating thread with return code 0 (success)
[vf#0:0 @ 0x159711440] Terminating thread with return code 0 (success)
[vost#0:0/wrapped_avframe @ 0x159710a80] Encoder thread received EOF
[vost#0:0/wrapped_avframe @ 0x159710a80] Terminating thread with return code 0 (success)
[af#0:1 @ 0x1496076e0] Terminating thread with return code 0 (success)
[out#0/null @ 0x159705380] All streams finished
[out#0/null @ 0x159705380] Terminating thread with return code 0 (success)
[out#0/null @ 0x159705380] Output file #0 (pipe:):
[out#0/null @ 0x159705380]   Output stream #0:0 (video): 1 frames encoded; 1 packets muxed (440 bytes); 
[out#0/null @ 0x159705380]   Output stream #0:1 (audio): 7408 frames encoded (8534016 samples); 7408 packets muxed (34136064 bytes); 
[out#0/null @ 0x159705380]   Total: 7409 packets (34136504 bytes) muxed
[out#0/null @ 0x159705380] video:0KiB audio:33336KiB subtitle:0KiB other streams:0KiB global headers:0KiB muxing overhead: unknown
frame=    1 fps=0.0 q=-0.0 Lsize=N/A time=00:00:00.00 bitrate=N/A speed=8.93e-05x    
[in#0/mp3 @ 0x159704310] Input file #0 (/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3):
[in#0/mp3 @ 0x159704310]   Input stream #0:0 (audio): 7408 packets read (4644363 bytes); 7408 frames decoded; 0 decode errors (8534016 samples); 
[in#0/mp3 @ 0x159704310]   Input stream #0:1 (video): 1 packets read (164183 bytes); 1 frames decoded; 0 decode errors; 
[in#0/mp3 @ 0x159704310]   Total: 7409 packets (4808546 bytes) demuxed
[AVIOContext @ 0x15a004680] Statistics: 4811195 bytes read, 0 seeks

@pdeljanov
Copy link
Owner

A couple question:

  1. Are you running a build from master or dev-0.6?
  2. Could you run symphonia-play with RUST_LOG=trace?

Also, if possible, providing the file (or enough the starting piece of it that repros the problem) would help a lot.

@daiyam
Copy link
Author

daiyam commented Feb 16, 2025

  1. Are you running a build from master or dev-0.6?

It was with master

  1. Could you run symphonia-play with RUST_LOG=trace?

The logs with dev-0.6:

❯ RUST_LOG=trace ./symphonia-play "/Volumes/Data/Music/Samples/Rie Fu/01 Waratte, Megumi no Moto he.mp3"
 TRACE symphonia_core::formats::probe > probing for trailing metadata at offset -160 (4811035)
 TRACE symphonia_core::formats::probe > probing for trailing metadata at offset -128 (4811067)
 TRACE symphonia_core::formats::probe > found the marker [54, 41, 47] @ 4811067 bytes
 DEBUG symphonia_core::formats::probe > selected metadata reader 'id3v1' with score 255
 DEBUG symphonia_core::formats::probe > appending 'id3v1' metadata
 DEBUG symphonia_core::formats::probe > skipping trailing metadata offset -32
 TRACE symphonia_core::formats::probe > found the marker [49, 44, 33] @ 0 bytes
 DEBUG symphonia_core::formats::probe > selected metadata reader 'id3v2' with score 255
 DEBUG symphonia_metadata::utils::images > detecting format of image starting with: [89, 50, 4e, 47, 0d, 0a, 1a, 0a]
 DEBUG symphonia_core::formats::probe    > appending 'id3v2' metadata
 TRACE symphonia_core::formats::probe    > found the marker [49, 44, 33] @ 164590 bytes
 DEBUG symphonia_core::formats::probe    > selected metadata reader 'id3v2' with score 255
 INFO  symphonia_play                    > the input is not supported
 ERROR symphonia_play                    > out of bounds

Also, if possible, providing the file (or enough the starting piece of it that repros the problem) would help a lot.

I'm looking into it.
How do you usually proceed? Since it's copyrighted material.

Not sure if it's relevant but when using https://github.com/mifi/lossless-cut to give you an extract, it detects to container as mp2...

@pdeljanov
Copy link
Owner

It looks like there may be a third ID3v2 tag in there since the ID3v1 tag and the first ID3v2 tag get appended to the metadata no problem. Probably just some junk data Symphonia needs to be more robust against.

I'd just need the contents of the file upto the first few audio frames. You could use the following command to get the first NUM_BYTES of a file:

head -c NUM_BYTES /path/to/input/file > /path/to/output/file

Per the log, we'll need more-than 164590 bytes since that's the position of that second ID3v2 tag. Maybe try 256 kB? As long as the audio format and codec is detected by ffmpeg/ffprobe on this truncated file then it should be good enough.

@daiyam
Copy link
Author

daiyam commented Feb 16, 2025

Here the sample: sample.mp3.zip

@pdeljanov
Copy link
Owner

Thanks.

The second ID3v2 tag is a version 2.3 tag, but states that it is a version 2.2 tag. The format between these two versions are different causing an invalid size to be read and used. This then causes an out-of-bounds read.

I'll have to sit on this one a bit to come up with an appropriate solution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@daiyam @pdeljanov