Paul B Mahol: > Signed-off-by: Paul B Mahol <one...@gmail.com> > --- > libavformat/Makefile | 1 + > libavformat/aaxdec.c | 324 +++++++++++++++++++++++++++++++++++++++ > libavformat/allformats.c | 1 + > 3 files changed, 326 insertions(+) > create mode 100644 libavformat/aaxdec.c > > diff --git a/libavformat/Makefile b/libavformat/Makefile > index b4cc467268..883326770f 100644 > --- a/libavformat/Makefile > +++ b/libavformat/Makefile > @@ -68,6 +68,7 @@ OBJS-$(CONFIG_SRTP) += srtp.o > OBJS-$(CONFIG_A64_MUXER) += a64.o rawenc.o > OBJS-$(CONFIG_AA_DEMUXER) += aadec.o > OBJS-$(CONFIG_AAC_DEMUXER) += aacdec.o apetag.o img2.o rawdec.o > +OBJS-$(CONFIG_AAX_DEMUXER) += aaxdec.o > OBJS-$(CONFIG_AC3_DEMUXER) += ac3dec.o rawdec.o > OBJS-$(CONFIG_AC3_MUXER) += rawenc.o > OBJS-$(CONFIG_ACM_DEMUXER) += acm.o rawdec.o > diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c > new file mode 100644 > index 0000000000..419fad9cc8 > --- /dev/null > +++ b/libavformat/aaxdec.c > @@ -0,0 +1,324 @@ > +/* > + * AAX demuxer > + * Copyright (c) 2020 Paul B Mahol > + * > + * This file is part of FFmpeg. > + * > + * FFmpeg is free software; you can redistribute it and/or > + * modify it under the terms of the GNU Lesser General Public > + * License as published by the Free Software Foundation; either > + * version 2.1 of the License, or (at your option) any later version. > + * > + * FFmpeg is distributed in the hope that it will be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > + * Lesser General Public License for more details. > + * > + * You should have received a copy of the GNU Lesser General Public > + * License along with FFmpeg; if not, write to the Free Software > + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 > USA > + */ > + > +#include "libavutil/intreadwrite.h" > +#include "avformat.h" > +#include "internal.h" > + > +typedef struct AAXColumn { > + uint8_t flag; > + uint8_t type; > + const char *name; > + uint32_t offset; > + int size; > +} AAXColumn; > + > +typedef struct AAXSegment { > + int64_t offset; > + uint32_t size; > +} AAXSegment; > + > +typedef struct AAXContext { > + int64_t table_size; > + uint16_t version; > + int64_t rows_offset; > + int64_t strings_offset; > + int64_t data_offset; > + int64_t name_offset; > + uint16_t columns; > + uint16_t row_width; > + uint32_t nb_segments; > + int64_t schema_offset; > + int64_t strings_size; > + char *string_table; > + > + int64_t prev_pts; > + int64_t last_segment_pts; > + int current_segment; > + > + AAXColumn *xcolumns; > + AAXSegment *segments; > +} AAXContext; > + > +static int aax_probe(const AVProbeData *p) > +{ > + if (AV_RB32(p->buf) != MKBETAG('@','U','T','F')) > + return 0; > + if (AV_RB16(p->buf + 4) <= 1U) > + return 0; > + > + return AVPROBE_SCORE_MAX; > +} > + > +enum ColumnFlag { > + COLUMN_FLAG_NAME = 0x1, > + COLUMN_FLAG_DEFAULT = 0x2, > + COLUMN_FLAG_ROW = 0x4, > + COLUMN_FLAG_UNDEFINED = 0x8 /* shouldn't exist */ > +}; > + > +enum ColumnType { > + COLUMN_TYPE_UINT8 = 0x00, > + COLUMN_TYPE_SINT8 = 0x01, > + COLUMN_TYPE_UINT16 = 0x02, > + COLUMN_TYPE_SINT16 = 0x03, > + COLUMN_TYPE_UINT32 = 0x04, > + COLUMN_TYPE_SINT32 = 0x05, > + COLUMN_TYPE_UINT64 = 0x06, > + COLUMN_TYPE_SINT64 = 0x07, > + COLUMN_TYPE_FLOAT = 0x08, > + COLUMN_TYPE_DOUBLE = 0x09, > + COLUMN_TYPE_STRING = 0x0a, > + COLUMN_TYPE_VLDATA = 0x0b, > + COLUMN_TYPE_UINT128 = 0x0c, /* for GUIDs */ > + COLUMN_TYPE_UNDEFINED = -1 > +}; > + > +static int aax_read_header(AVFormatContext *s) > +{ > + AAXContext *a = s->priv_data; > + AVIOContext *pb = s->pb; > + AVCodecParameters *par; > + AVStream *st; > + int64_t column_offset = 0; > + char *codec; > + int ret, extradata_size; > + > + avio_skip(pb, 4); > + a->table_size = avio_rb32(pb) + 8LL; > + a->version = avio_rb16(pb); > + a->rows_offset = avio_rb16(pb) + 8LL; > + a->strings_offset = avio_rb32(pb) + 8LL; > + a->data_offset = avio_rb32(pb) + 8LL; > + a->name_offset = avio_rb32(pb); > + a->columns = avio_rb16(pb); > + a->row_width = avio_rb16(pb); > + a->nb_segments = avio_rb32(pb); > + > + a->schema_offset = 0x20; > + a->strings_size = a->data_offset - a->strings_offset; > + > + if (a->rows_offset > a->table_size || > + a->strings_offset > a->table_size || > + a->data_offset > a->table_size) > + return AVERROR_INVALIDDATA; > + if (a->strings_size <= 0 || a->name_offset > a->strings_size || > + a->strings_size > UINT16_MAX) > + return AVERROR_INVALIDDATA; > + if (a->columns <= 0) > + return AVERROR_INVALIDDATA; > + > + av_freep(&a->segments); > + a->segments = av_calloc(a->nb_segments, sizeof(*a->segments)); > + if (!a->segments) > + return AVERROR(ENOMEM); > + > + av_freep(&a->xcolumns); > + a->xcolumns = av_calloc(a->columns, sizeof(*a->xcolumns)); > + if (!a->xcolumns) > + return AVERROR(ENOMEM); > + > + av_freep(&a->string_table); > + a->string_table = av_calloc(a->strings_size + 1, > sizeof(*a->string_table)); > + if (!a->string_table) > + return AVERROR(ENOMEM); > + > + for (int c = 0; c < a->columns; c++) { > + uint8_t info = avio_r8(pb); > + uint32_t offset = avio_rb32(pb); > + int value_size; > + > + if (offset >= a->strings_size) > + return AVERROR_INVALIDDATA; > + > + a->xcolumns[c].flag = info >> 4; > + a->xcolumns[c].type = info & 0x0F; > + > + switch (a->xcolumns[c].type) { > + case COLUMN_TYPE_UINT8: > + case COLUMN_TYPE_SINT8: > + value_size = 0x01; > + break; > + case COLUMN_TYPE_UINT16: > + case COLUMN_TYPE_SINT16: > + value_size = 0x02; > + break; > + case COLUMN_TYPE_UINT32: > + case COLUMN_TYPE_SINT32: > + case COLUMN_TYPE_FLOAT: > + case COLUMN_TYPE_STRING: > + value_size = 0x04; > + break; > + case COLUMN_TYPE_VLDATA: > + value_size = 0x08; > + break; > + case COLUMN_TYPE_UINT128: > + value_size = 0x10; > + break; > + default: > + return AVERROR_INVALIDDATA; > + } > + > + a->xcolumns[c].size = value_size; > + > + if (a->xcolumns[c].flag & COLUMN_FLAG_NAME) > + a->xcolumns[c].name = a->string_table + offset; > + > + if (a->xcolumns[c].flag & COLUMN_FLAG_DEFAULT) { > + /* data is found relative to columns start */ > + a->xcolumns[c].offset = avio_tell(pb) - a->schema_offset; > + avio_skip(pb, value_size); > + } > + > + if (a->xcolumns[c].flag & COLUMN_FLAG_ROW) { > + /* data is found relative to row start */ > + a->xcolumns[c].offset = column_offset; > + column_offset += value_size; > + } > + } > + > + avio_seek(pb, a->strings_offset, SEEK_SET); > + ret = avio_read(pb, a->string_table, a->strings_size); > + if (ret != a->strings_size) { > + if (ret < 0) > + return ret; > + return AVERROR(EIO); > + } > + > + for (int c = 0; c < a->columns; c++) { > + int64_t data_offset = 0; > + int64_t col_offset; > + int flag, type; > + > + if (strcmp(a->xcolumns[c].name, "data")) > + continue; > + > + type = a->xcolumns[c].type; > + flag = a->xcolumns[c].flag; > + col_offset = a->xcolumns[c].offset; > + > + for (int r = 0; r < a->nb_segments; r++) { > + if (flag & COLUMN_FLAG_DEFAULT) { > + data_offset = a->schema_offset + col_offset; > + } else if (flag & COLUMN_FLAG_ROW) { > + data_offset = a->rows_offset + r * a->row_width + col_offset; > + } else { > + return AVERROR_INVALIDDATA; > + } > + > + avio_seek(pb, data_offset, SEEK_SET); > + if (type == COLUMN_TYPE_VLDATA) { > + a->segments[r].offset = avio_rb32(pb) + 0x58; > + a->segments[r].size = avio_rb32(pb); > + } else { > + return AVERROR_INVALIDDATA; > + } > + } > + } > + > + st = avformat_new_stream(s, NULL); > + if (!st) > + return AVERROR(ENOMEM); > + par = s->streams[0]->codecpar; > + par->codec_type = AVMEDIA_TYPE_AUDIO; > + > + codec = a->string_table + a->name_offset; > + if (!strcmp(codec, "AAX")) { > + par->codec_id = AV_CODEC_ID_ADPCM_ADX; > + } else if (!strcmp(codec, "HCA") ){ > + par->codec_id = AV_CODEC_ID_HCA; > + } else { > + return AVERROR_INVALIDDATA; > + } > + > + avio_seek(pb, a->segments[0].offset, SEEK_SET); > + if (avio_rb16(pb) != 0x8000) > + return AVERROR_INVALIDDATA; > + extradata_size = avio_rb16(pb) + 4; > + if (extradata_size < 12) > + return AVERROR_INVALIDDATA; > + avio_seek(pb, -4, SEEK_CUR); > + ff_get_extradata(s, par, pb, extradata_size); > + par->channels = AV_RB8 (par->extradata + 7); > + par->sample_rate = AV_RB32(par->extradata + 8); > + > + avpriv_set_pts_info(st, 64, 32, par->sample_rate); > + > + return 0; > +} > + > +static int aax_read_packet(AVFormatContext *s, AVPacket *pkt) > +{ > + AAXContext *a = s->priv_data; > + AVCodecParameters *par = s->streams[0]->codecpar; > + AVIOContext *pb = s->pb; > + const int size = 18 * par->channels; > + int ret, extradata_size = 0; > + uint8_t *dst = NULL; > + > + if (avio_feof(pb)) > + return AVERROR_EOF; > + > + if (avio_tell(pb) >= a->segments[a->current_segment].offset + > + a->segments[a->current_segment].size) { > + if (a->current_segment + 1 == a->nb_segments) > + return AVERROR_EOF; > + a->last_segment_pts = a->prev_pts; > + a->current_segment++; > + avio_seek(pb, a->segments[a->current_segment].offset, SEEK_SET); > + if (avio_rb16(pb) != 0x8000) > + return AVERROR_INVALIDDATA; > + extradata_size = avio_rb16(pb) + 4; > + avio_seek(pb, -4, SEEK_CUR); > + if (extradata_size < 12) > + return AVERROR_INVALIDDATA; > + dst = av_packet_new_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, > extradata_size); > + if (!dst) > + return AVERROR(ENOMEM); > + avio_read(pb, dst, extradata_size); > + } > + > + pkt->pos = avio_tell(pb); > + ret = av_get_packet(pb, pkt, size); > + pkt->duration = 1; > + pkt->stream_index = 0; > + pkt->pts = a->last_segment_pts + ((pkt->pos - > a->segments[a->current_segment].offset) / size); > + a->prev_pts = pkt->pts; > + > + if (dst) { > + ret = av_packet_add_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, dst, > extradata_size); > + if (ret < 0) > + return ret; > + }
Adding the extradata twice is wrong: av_get_packet() will initialize the packet which will leak the side_data array. It will also make dst no longer owned by the packet, yet this is extremely fragile and seems like an API violation. > + > + return ret; > +} > + > +AVInputFormat ff_aax_demuxer = { > + .name = "aax", > + .long_name = NULL_IF_CONFIG_SMALL("CRI AAX"), > + .priv_data_size = sizeof(AAXContext), > + .read_probe = aax_probe, > + .read_header = aax_read_header, > + .read_packet = aax_read_packet, > + .extensions = "aax", > + .flags = AVFMT_GENERIC_INDEX, > +}; > diff --git a/libavformat/allformats.c b/libavformat/allformats.c > index a23eb9e7fa..d3af6f7f18 100644 > --- a/libavformat/allformats.c > +++ b/libavformat/allformats.c > @@ -31,6 +31,7 @@ > extern AVOutputFormat ff_a64_muxer; > extern AVInputFormat ff_aa_demuxer; > extern AVInputFormat ff_aac_demuxer; > +extern AVInputFormat ff_aax_demuxer; > extern AVInputFormat ff_ac3_demuxer; > extern AVOutputFormat ff_ac3_muxer; > extern AVInputFormat ff_acm_demuxer; > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".