From a7fd98442d3af98c25453f4b4a5df897b3666c76 Mon Sep 17 00:00:00 2001
From: Syed AbuTalib <lowkey@google.com>
Date: Fri, 25 Sep 2026 12:38:09 -0700
Subject: [PATCH] Use AudioCodecProfile for IamfSpecificBox.profile

Harden profile against invalid values such as negatives. As according to
the spec section 4 ("Profiles"), the profile MUST have one of the values
of [0,1].

Bug: 560476932
Change-Id: I05ec375fb78171d11072e132344786c8499c5a2e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8455582
Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Syed AbuTalib <lowkey@google.com>
Cr-Commit-Position: refs/heads/main@{#1705062}
---
diff --git a/media/formats/mp4/box_definitions.cc b/media/formats/mp4/box_definitions.cc
index 88299b6..bc691a4c 100644
--- a/media/formats/mp4/box_definitions.cc
+++ b/media/formats/mp4/box_definitions.cc
@@ -1790,6 +1790,7 @@
     RCHECK(ReadOBU(&config_reader));
   }
 
+  RCHECK(profile != AudioCodecProfile::kUnknown);
   return true;
 }
 
@@ -1804,15 +1805,27 @@
     case kIamfConfigObuTypeAudioElement:
     case kIamfConfigObuTypeMixPresentation:
       break;
-    case kIamfConfigObuTypeSequenceHeader:
+    case kIamfConfigObuTypeSequenceHeader: {
       uint32_t ia_code;
       RCHECK(reader->Read4(&ia_code));
       RCHECK(ia_code == FOURCC_IAMF);
 
-      RCHECK(reader->Read1(&profile));
-      RCHECK(profile <= 1);
-
+      uint8_t primary_profile;
+      RCHECK(reader->Read1(&primary_profile));
+      switch (primary_profile) {
+        case 0:
+          profile = AudioCodecProfile::kIAMF_SIMPLE;
+          break;
+        case 1:
+          profile = AudioCodecProfile::kIAMF_BASE;
+          break;
+        default:
+          DVLOG(1) << "Unhandled IAMF primary_profile "
+                   << static_cast<int>(primary_profile);
+          return false;
+      }
       break;
+    }
     default:
       DVLOG(1) << "Unhandled IAMF OBU type " << static_cast<int>(obu_type);
       return false;
diff --git a/media/formats/mp4/box_definitions.h b/media/formats/mp4/box_definitions.h
index ed40f014..08cf9684e 100644
--- a/media/formats/mp4/box_definitions.h
+++ b/media/formats/mp4/box_definitions.h
@@ -15,6 +15,7 @@
 
 #include "base/compiler_specific.h"
 #include "base/time/time.h"
+#include "media/base/audio_codecs.h"
 #include "media/base/decrypt_config.h"
 #include "media/base/media_export.h"
 #include "media/base/media_log.h"
@@ -488,7 +489,7 @@
                      uint32_t* obu_size);
   bool ReadLeb128Value(BufferReader* reader, uint32_t* value) const;
 
-  uint8_t profile;
+  AudioCodecProfile profile = AudioCodecProfile::kUnknown;
   bool redundant_copy = false;
 
   std::vector<uint8_t> ia_descriptors;
diff --git a/media/formats/mp4/mp4_stream_parser.cc b/media/formats/mp4/mp4_stream_parser.cc
index 8080b076..111d8560 100644
--- a/media/formats/mp4/mp4_stream_parser.cc
+++ b/media/formats/mp4/mp4_stream_parser.cc
@@ -568,8 +568,7 @@
         }
 
         codec = AudioCodec::kIAMF;
-        profile = entry.iacb.profile == 0 ? AudioCodecProfile::kIAMF_SIMPLE
-                                          : AudioCodecProfile::kIAMF_BASE;
+        profile = entry.iacb.profile;
         extra_data = entry.iacb.ia_descriptors;
 
         // The correct values for the channel layout and sample rate can