diff mbox series

[FFmpeg-devel,1/2] avformat: add CRI AAX demuxer

Message ID 20200912223321.21856-1-onemda@gmail.com
State Superseded
Headers show
Series [FFmpeg-devel,1/2] avformat: add CRI AAX demuxer
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Paul B Mahol Sept. 12, 2020, 10:33 p.m. UTC
Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavformat/Makefile     |   1 +
 libavformat/aaxdec.c     | 324 +++++++++++++++++++++++++++++++++++++++
 libavformat/allformats.c |   1 +
 3 files changed, 326 insertions(+)
 create mode 100644 libavformat/aaxdec.c

Comments

James Almer Sept. 12, 2020, 10:40 p.m. UTC | #1
On 9/12/2020 7:33 PM, Paul B Mahol wrote:
> +static int aax_read_packet(AVFormatContext *s, AVPacket *pkt)
> +{
> +    AAXContext *a = s->priv_data;
> +    AVCodecParameters *par = s->streams[0]->codecpar;
> +    AVIOContext *pb = s->pb;
> +    const int size = 18 * par->channels;
> +    int ret, extradata_size = 0;
> +    uint8_t *dst = NULL;
> +
> +    if (avio_feof(pb))
> +        return AVERROR_EOF;
> +
> +    if (avio_tell(pb) >= a->segments[a->current_segment].offset +
> +                         a->segments[a->current_segment].size) {
> +        if (a->current_segment + 1 == a->nb_segments)
> +            return AVERROR_EOF;
> +        a->last_segment_pts = a->prev_pts;
> +        a->current_segment++;
> +        avio_seek(pb, a->segments[a->current_segment].offset, SEEK_SET);
> +        if (avio_rb16(pb) != 0x8000)
> +            return AVERROR_INVALIDDATA;
> +        extradata_size = avio_rb16(pb) + 4;
> +        avio_seek(pb, -4, SEEK_CUR);
> +        if (extradata_size < 12)
> +            return AVERROR_INVALIDDATA;
> +        dst = av_packet_new_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, extradata_size);
> +        if (!dst)
> +            return AVERROR(ENOMEM);
> +        avio_read(pb, dst, extradata_size);
> +    }
> +
> +    pkt->pos = avio_tell(pb);
> +    ret = av_get_packet(pb, pkt, size);

This will call av_init_packet() internally, meaning the side data you
allocated above will be lost...

> +    pkt->duration = 1;
> +    pkt->stream_index = 0;
> +    pkt->pts = a->last_segment_pts + ((pkt->pos - a->segments[a->current_segment].offset) / size);
> +    a->prev_pts = pkt->pts;
> +
> +    if (dst) {
> +        ret = av_packet_add_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, dst, extradata_size);

...and then readded by this.

Just replace the av_packet_new_side_data() call above with an
av_mallocz() one.

> +        if (ret < 0)
> +            return ret;
> +    }
> +
> +    return ret;
> +}
Andreas Rheinhardt Sept. 12, 2020, 10:40 p.m. UTC | #2
Paul B Mahol:
> Signed-off-by: Paul B Mahol <onemda@gmail.com>
> ---
>  libavformat/Makefile     |   1 +
>  libavformat/aaxdec.c     | 324 +++++++++++++++++++++++++++++++++++++++
>  libavformat/allformats.c |   1 +
>  3 files changed, 326 insertions(+)
>  create mode 100644 libavformat/aaxdec.c
> 
> diff --git a/libavformat/Makefile b/libavformat/Makefile
> index b4cc467268..883326770f 100644
> --- a/libavformat/Makefile
> +++ b/libavformat/Makefile
> @@ -68,6 +68,7 @@ OBJS-$(CONFIG_SRTP)                      += srtp.o
>  OBJS-$(CONFIG_A64_MUXER)                 += a64.o rawenc.o
>  OBJS-$(CONFIG_AA_DEMUXER)                += aadec.o
>  OBJS-$(CONFIG_AAC_DEMUXER)               += aacdec.o apetag.o img2.o rawdec.o
> +OBJS-$(CONFIG_AAX_DEMUXER)               += aaxdec.o
>  OBJS-$(CONFIG_AC3_DEMUXER)               += ac3dec.o rawdec.o
>  OBJS-$(CONFIG_AC3_MUXER)                 += rawenc.o
>  OBJS-$(CONFIG_ACM_DEMUXER)               += acm.o rawdec.o
> diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c
> new file mode 100644
> index 0000000000..419fad9cc8
> --- /dev/null
> +++ b/libavformat/aaxdec.c
> @@ -0,0 +1,324 @@
> +/*
> + * AAX demuxer
> + * Copyright (c) 2020 Paul B Mahol
> + *
> + * This file is part of FFmpeg.
> + *
> + * FFmpeg is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Lesser General Public
> + * License as published by the Free Software Foundation; either
> + * version 2.1 of the License, or (at your option) any later version.
> + *
> + * FFmpeg is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> + * Lesser General Public License for more details.
> + *
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with FFmpeg; if not, write to the Free Software
> + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
> + */
> +
> +#include "libavutil/intreadwrite.h"
> +#include "avformat.h"
> +#include "internal.h"
> +
> +typedef struct AAXColumn {
> +    uint8_t flag;
> +    uint8_t type;
> +    const char *name;
> +    uint32_t offset;
> +    int size;
> +} AAXColumn;
> +
> +typedef struct AAXSegment {
> +    int64_t offset;
> +    uint32_t size;
> +} AAXSegment;
> +
> +typedef struct AAXContext {
> +    int64_t table_size;
> +    uint16_t version;
> +    int64_t rows_offset;
> +    int64_t strings_offset;
> +    int64_t data_offset;
> +    int64_t name_offset;
> +    uint16_t columns;
> +    uint16_t row_width;
> +    uint32_t nb_segments;
> +    int64_t schema_offset;
> +    int64_t strings_size;
> +    char *string_table;
> +
> +    int64_t prev_pts;
> +    int64_t last_segment_pts;
> +    int current_segment;
> +
> +    AAXColumn *xcolumns;
> +    AAXSegment *segments;
> +} AAXContext;
> +
> +static int aax_probe(const AVProbeData *p)
> +{
> +    if (AV_RB32(p->buf) != MKBETAG('@','U','T','F'))
> +        return 0;
> +    if (AV_RB16(p->buf + 4) <= 1U)
> +        return 0;
> +
> +    return AVPROBE_SCORE_MAX;
> +}
> +
> +enum ColumnFlag {
> +    COLUMN_FLAG_NAME            = 0x1,
> +    COLUMN_FLAG_DEFAULT         = 0x2,
> +    COLUMN_FLAG_ROW             = 0x4,
> +    COLUMN_FLAG_UNDEFINED       = 0x8 /* shouldn't exist */
> +};
> +
> +enum ColumnType {
> +    COLUMN_TYPE_UINT8           = 0x00,
> +    COLUMN_TYPE_SINT8           = 0x01,
> +    COLUMN_TYPE_UINT16          = 0x02,
> +    COLUMN_TYPE_SINT16          = 0x03,
> +    COLUMN_TYPE_UINT32          = 0x04,
> +    COLUMN_TYPE_SINT32          = 0x05,
> +    COLUMN_TYPE_UINT64          = 0x06,
> +    COLUMN_TYPE_SINT64          = 0x07,
> +    COLUMN_TYPE_FLOAT           = 0x08,
> +    COLUMN_TYPE_DOUBLE          = 0x09,
> +    COLUMN_TYPE_STRING          = 0x0a,
> +    COLUMN_TYPE_VLDATA          = 0x0b,
> +    COLUMN_TYPE_UINT128         = 0x0c, /* for GUIDs */
> +    COLUMN_TYPE_UNDEFINED       = -1
> +};
> +
> +static int aax_read_header(AVFormatContext *s)
> +{
> +    AAXContext *a = s->priv_data;
> +    AVIOContext *pb = s->pb;
> +    AVCodecParameters *par;
> +    AVStream *st;
> +    int64_t column_offset = 0;
> +    char *codec;
> +    int ret, extradata_size;
> +
> +    avio_skip(pb, 4);
> +    a->table_size      = avio_rb32(pb) + 8LL;
> +    a->version         = avio_rb16(pb);
> +    a->rows_offset     = avio_rb16(pb) + 8LL;
> +    a->strings_offset  = avio_rb32(pb) + 8LL;
> +    a->data_offset     = avio_rb32(pb) + 8LL;
> +    a->name_offset     = avio_rb32(pb);
> +    a->columns         = avio_rb16(pb);
> +    a->row_width       = avio_rb16(pb);
> +    a->nb_segments     = avio_rb32(pb);
> +
> +    a->schema_offset   = 0x20;
> +    a->strings_size    = a->data_offset - a->strings_offset;
> +
> +    if (a->rows_offset > a->table_size ||
> +        a->strings_offset > a->table_size ||
> +        a->data_offset > a->table_size)
> +        return AVERROR_INVALIDDATA;
> +    if (a->strings_size <= 0 || a->name_offset > a->strings_size ||
> +        a->strings_size > UINT16_MAX)
> +        return AVERROR_INVALIDDATA;
> +    if (a->columns <= 0)
> +        return AVERROR_INVALIDDATA;
> +
> +    av_freep(&a->segments);
> +    a->segments = av_calloc(a->nb_segments, sizeof(*a->segments));
> +    if (!a->segments)
> +        return AVERROR(ENOMEM);
> +
> +    av_freep(&a->xcolumns);
> +    a->xcolumns = av_calloc(a->columns, sizeof(*a->xcolumns));
> +    if (!a->xcolumns)
> +        return AVERROR(ENOMEM);
> +
> +    av_freep(&a->string_table);
> +    a->string_table = av_calloc(a->strings_size + 1, sizeof(*a->string_table));
> +    if (!a->string_table)
> +        return AVERROR(ENOMEM);
> +
> +    for (int c = 0; c < a->columns; c++) {
> +        uint8_t info = avio_r8(pb);
> +        uint32_t offset = avio_rb32(pb);
> +        int value_size;
> +
> +        if (offset >= a->strings_size)
> +            return AVERROR_INVALIDDATA;
> +
> +        a->xcolumns[c].flag = info >>   4;
> +        a->xcolumns[c].type = info & 0x0F;
> +
> +        switch (a->xcolumns[c].type) {
> +        case COLUMN_TYPE_UINT8:
> +        case COLUMN_TYPE_SINT8:
> +            value_size = 0x01;
> +            break;
> +        case COLUMN_TYPE_UINT16:
> +        case COLUMN_TYPE_SINT16:
> +            value_size = 0x02;
> +            break;
> +        case COLUMN_TYPE_UINT32:
> +        case COLUMN_TYPE_SINT32:
> +        case COLUMN_TYPE_FLOAT:
> +        case COLUMN_TYPE_STRING:
> +            value_size = 0x04;
> +            break;
> +        case COLUMN_TYPE_VLDATA:
> +            value_size = 0x08;
> +            break;
> +        case COLUMN_TYPE_UINT128:
> +            value_size = 0x10;
> +            break;
> +        default:
> +            return AVERROR_INVALIDDATA;
> +        }
> +
> +        a->xcolumns[c].size = value_size;
> +
> +        if (a->xcolumns[c].flag & COLUMN_FLAG_NAME)
> +            a->xcolumns[c].name = a->string_table + offset;
> +
> +        if (a->xcolumns[c].flag & COLUMN_FLAG_DEFAULT) {
> +            /* data is found relative to columns start */
> +            a->xcolumns[c].offset = avio_tell(pb) - a->schema_offset;
> +            avio_skip(pb, value_size);
> +        }
> +
> +        if (a->xcolumns[c].flag & COLUMN_FLAG_ROW) {
> +            /* data is found relative to row start */
> +            a->xcolumns[c].offset = column_offset;
> +            column_offset += value_size;
> +        }
> +    }
> +
> +    avio_seek(pb, a->strings_offset, SEEK_SET);
> +    ret = avio_read(pb, a->string_table, a->strings_size);
> +    if (ret != a->strings_size) {
> +        if (ret < 0)
> +            return ret;
> +        return AVERROR(EIO);
> +    }
> +
> +    for (int c = 0; c < a->columns; c++) {
> +        int64_t data_offset = 0;
> +        int64_t col_offset;
> +        int flag, type;
> +
> +        if (strcmp(a->xcolumns[c].name, "data"))
> +            continue;
> +
> +        type = a->xcolumns[c].type;
> +        flag = a->xcolumns[c].flag;
> +        col_offset = a->xcolumns[c].offset;
> +
> +        for (int r = 0; r < a->nb_segments; r++) {
> +            if (flag & COLUMN_FLAG_DEFAULT) {
> +                data_offset = a->schema_offset + col_offset;
> +            } else if (flag & COLUMN_FLAG_ROW) {
> +                data_offset = a->rows_offset + r * a->row_width + col_offset;
> +            } else {
> +                return AVERROR_INVALIDDATA;
> +            }
> +
> +            avio_seek(pb, data_offset, SEEK_SET);
> +            if (type == COLUMN_TYPE_VLDATA) {
> +                a->segments[r].offset = avio_rb32(pb) + 0x58;
> +                a->segments[r].size   = avio_rb32(pb);
> +            } else {
> +                return AVERROR_INVALIDDATA;
> +            }
> +        }
> +    }
> +
> +    st = avformat_new_stream(s, NULL);
> +    if (!st)
> +        return AVERROR(ENOMEM);
> +    par = s->streams[0]->codecpar;
> +    par->codec_type = AVMEDIA_TYPE_AUDIO;
> +
> +    codec = a->string_table + a->name_offset;
> +    if (!strcmp(codec, "AAX")) {
> +        par->codec_id = AV_CODEC_ID_ADPCM_ADX;
> +    } else if (!strcmp(codec, "HCA") ){
> +        par->codec_id = AV_CODEC_ID_HCA;
> +    } else {
> +        return AVERROR_INVALIDDATA;
> +    }
> +
> +    avio_seek(pb, a->segments[0].offset, SEEK_SET);
> +    if (avio_rb16(pb) != 0x8000)
> +        return AVERROR_INVALIDDATA;
> +    extradata_size = avio_rb16(pb) + 4;
> +    if (extradata_size < 12)
> +        return AVERROR_INVALIDDATA;
> +    avio_seek(pb, -4, SEEK_CUR);
> +    ff_get_extradata(s, par, pb, extradata_size);
> +    par->channels    = AV_RB8 (par->extradata + 7);
> +    par->sample_rate = AV_RB32(par->extradata + 8);
> +
> +    avpriv_set_pts_info(st, 64, 32, par->sample_rate);
> +
> +    return 0;
> +}
> +
> +static int aax_read_packet(AVFormatContext *s, AVPacket *pkt)
> +{
> +    AAXContext *a = s->priv_data;
> +    AVCodecParameters *par = s->streams[0]->codecpar;
> +    AVIOContext *pb = s->pb;
> +    const int size = 18 * par->channels;
> +    int ret, extradata_size = 0;
> +    uint8_t *dst = NULL;
> +
> +    if (avio_feof(pb))
> +        return AVERROR_EOF;
> +
> +    if (avio_tell(pb) >= a->segments[a->current_segment].offset +
> +                         a->segments[a->current_segment].size) {
> +        if (a->current_segment + 1 == a->nb_segments)
> +            return AVERROR_EOF;
> +        a->last_segment_pts = a->prev_pts;
> +        a->current_segment++;
> +        avio_seek(pb, a->segments[a->current_segment].offset, SEEK_SET);
> +        if (avio_rb16(pb) != 0x8000)
> +            return AVERROR_INVALIDDATA;
> +        extradata_size = avio_rb16(pb) + 4;
> +        avio_seek(pb, -4, SEEK_CUR);
> +        if (extradata_size < 12)
> +            return AVERROR_INVALIDDATA;
> +        dst = av_packet_new_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, extradata_size);
> +        if (!dst)
> +            return AVERROR(ENOMEM);
> +        avio_read(pb, dst, extradata_size);
> +    }
> +
> +    pkt->pos = avio_tell(pb);
> +    ret = av_get_packet(pb, pkt, size);
> +    pkt->duration = 1;
> +    pkt->stream_index = 0;
> +    pkt->pts = a->last_segment_pts + ((pkt->pos - a->segments[a->current_segment].offset) / size);
> +    a->prev_pts = pkt->pts;
> +
> +    if (dst) {
> +        ret = av_packet_add_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, dst, extradata_size);
> +        if (ret < 0)
> +            return ret;
> +    }

Adding the extradata twice is wrong: av_get_packet() will initialize the
packet which will leak the side_data array. It will also make dst no
longer owned by the packet, yet this is extremely fragile and seems like
an API violation.

> +
> +    return ret;
> +}
> +
> +AVInputFormat ff_aax_demuxer = {
> +    .name           = "aax",
> +    .long_name      = NULL_IF_CONFIG_SMALL("CRI AAX"),
> +    .priv_data_size = sizeof(AAXContext),
> +    .read_probe     = aax_probe,
> +    .read_header    = aax_read_header,
> +    .read_packet    = aax_read_packet,
> +    .extensions     = "aax",
> +    .flags          = AVFMT_GENERIC_INDEX,
> +};
> diff --git a/libavformat/allformats.c b/libavformat/allformats.c
> index a23eb9e7fa..d3af6f7f18 100644
> --- a/libavformat/allformats.c
> +++ b/libavformat/allformats.c
> @@ -31,6 +31,7 @@
>  extern AVOutputFormat ff_a64_muxer;
>  extern AVInputFormat  ff_aa_demuxer;
>  extern AVInputFormat  ff_aac_demuxer;
> +extern AVInputFormat  ff_aax_demuxer;
>  extern AVInputFormat  ff_ac3_demuxer;
>  extern AVOutputFormat ff_ac3_muxer;
>  extern AVInputFormat  ff_acm_demuxer;
>
diff mbox series

Patch

diff --git a/libavformat/Makefile b/libavformat/Makefile
index b4cc467268..883326770f 100644
--- a/libavformat/Makefile
+++ b/libavformat/Makefile
@@ -68,6 +68,7 @@  OBJS-$(CONFIG_SRTP)                      += srtp.o
 OBJS-$(CONFIG_A64_MUXER)                 += a64.o rawenc.o
 OBJS-$(CONFIG_AA_DEMUXER)                += aadec.o
 OBJS-$(CONFIG_AAC_DEMUXER)               += aacdec.o apetag.o img2.o rawdec.o
+OBJS-$(CONFIG_AAX_DEMUXER)               += aaxdec.o
 OBJS-$(CONFIG_AC3_DEMUXER)               += ac3dec.o rawdec.o
 OBJS-$(CONFIG_AC3_MUXER)                 += rawenc.o
 OBJS-$(CONFIG_ACM_DEMUXER)               += acm.o rawdec.o
diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c
new file mode 100644
index 0000000000..419fad9cc8
--- /dev/null
+++ b/libavformat/aaxdec.c
@@ -0,0 +1,324 @@ 
+/*
+ * AAX demuxer
+ * Copyright (c) 2020 Paul B Mahol
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "libavutil/intreadwrite.h"
+#include "avformat.h"
+#include "internal.h"
+
+typedef struct AAXColumn {
+    uint8_t flag;
+    uint8_t type;
+    const char *name;
+    uint32_t offset;
+    int size;
+} AAXColumn;
+
+typedef struct AAXSegment {
+    int64_t offset;
+    uint32_t size;
+} AAXSegment;
+
+typedef struct AAXContext {
+    int64_t table_size;
+    uint16_t version;
+    int64_t rows_offset;
+    int64_t strings_offset;
+    int64_t data_offset;
+    int64_t name_offset;
+    uint16_t columns;
+    uint16_t row_width;
+    uint32_t nb_segments;
+    int64_t schema_offset;
+    int64_t strings_size;
+    char *string_table;
+
+    int64_t prev_pts;
+    int64_t last_segment_pts;
+    int current_segment;
+
+    AAXColumn *xcolumns;
+    AAXSegment *segments;
+} AAXContext;
+
+static int aax_probe(const AVProbeData *p)
+{
+    if (AV_RB32(p->buf) != MKBETAG('@','U','T','F'))
+        return 0;
+    if (AV_RB16(p->buf + 4) <= 1U)
+        return 0;
+
+    return AVPROBE_SCORE_MAX;
+}
+
+enum ColumnFlag {
+    COLUMN_FLAG_NAME            = 0x1,
+    COLUMN_FLAG_DEFAULT         = 0x2,
+    COLUMN_FLAG_ROW             = 0x4,
+    COLUMN_FLAG_UNDEFINED       = 0x8 /* shouldn't exist */
+};
+
+enum ColumnType {
+    COLUMN_TYPE_UINT8           = 0x00,
+    COLUMN_TYPE_SINT8           = 0x01,
+    COLUMN_TYPE_UINT16          = 0x02,
+    COLUMN_TYPE_SINT16          = 0x03,
+    COLUMN_TYPE_UINT32          = 0x04,
+    COLUMN_TYPE_SINT32          = 0x05,
+    COLUMN_TYPE_UINT64          = 0x06,
+    COLUMN_TYPE_SINT64          = 0x07,
+    COLUMN_TYPE_FLOAT           = 0x08,
+    COLUMN_TYPE_DOUBLE          = 0x09,
+    COLUMN_TYPE_STRING          = 0x0a,
+    COLUMN_TYPE_VLDATA          = 0x0b,
+    COLUMN_TYPE_UINT128         = 0x0c, /* for GUIDs */
+    COLUMN_TYPE_UNDEFINED       = -1
+};
+
+static int aax_read_header(AVFormatContext *s)
+{
+    AAXContext *a = s->priv_data;
+    AVIOContext *pb = s->pb;
+    AVCodecParameters *par;
+    AVStream *st;
+    int64_t column_offset = 0;
+    char *codec;
+    int ret, extradata_size;
+
+    avio_skip(pb, 4);
+    a->table_size      = avio_rb32(pb) + 8LL;
+    a->version         = avio_rb16(pb);
+    a->rows_offset     = avio_rb16(pb) + 8LL;
+    a->strings_offset  = avio_rb32(pb) + 8LL;
+    a->data_offset     = avio_rb32(pb) + 8LL;
+    a->name_offset     = avio_rb32(pb);
+    a->columns         = avio_rb16(pb);
+    a->row_width       = avio_rb16(pb);
+    a->nb_segments     = avio_rb32(pb);
+
+    a->schema_offset   = 0x20;
+    a->strings_size    = a->data_offset - a->strings_offset;
+
+    if (a->rows_offset > a->table_size ||
+        a->strings_offset > a->table_size ||
+        a->data_offset > a->table_size)
+        return AVERROR_INVALIDDATA;
+    if (a->strings_size <= 0 || a->name_offset > a->strings_size ||
+        a->strings_size > UINT16_MAX)
+        return AVERROR_INVALIDDATA;
+    if (a->columns <= 0)
+        return AVERROR_INVALIDDATA;
+
+    av_freep(&a->segments);
+    a->segments = av_calloc(a->nb_segments, sizeof(*a->segments));
+    if (!a->segments)
+        return AVERROR(ENOMEM);
+
+    av_freep(&a->xcolumns);
+    a->xcolumns = av_calloc(a->columns, sizeof(*a->xcolumns));
+    if (!a->xcolumns)
+        return AVERROR(ENOMEM);
+
+    av_freep(&a->string_table);
+    a->string_table = av_calloc(a->strings_size + 1, sizeof(*a->string_table));
+    if (!a->string_table)
+        return AVERROR(ENOMEM);
+
+    for (int c = 0; c < a->columns; c++) {
+        uint8_t info = avio_r8(pb);
+        uint32_t offset = avio_rb32(pb);
+        int value_size;
+
+        if (offset >= a->strings_size)
+            return AVERROR_INVALIDDATA;
+
+        a->xcolumns[c].flag = info >>   4;
+        a->xcolumns[c].type = info & 0x0F;
+
+        switch (a->xcolumns[c].type) {
+        case COLUMN_TYPE_UINT8:
+        case COLUMN_TYPE_SINT8:
+            value_size = 0x01;
+            break;
+        case COLUMN_TYPE_UINT16:
+        case COLUMN_TYPE_SINT16:
+            value_size = 0x02;
+            break;
+        case COLUMN_TYPE_UINT32:
+        case COLUMN_TYPE_SINT32:
+        case COLUMN_TYPE_FLOAT:
+        case COLUMN_TYPE_STRING:
+            value_size = 0x04;
+            break;
+        case COLUMN_TYPE_VLDATA:
+            value_size = 0x08;
+            break;
+        case COLUMN_TYPE_UINT128:
+            value_size = 0x10;
+            break;
+        default:
+            return AVERROR_INVALIDDATA;
+        }
+
+        a->xcolumns[c].size = value_size;
+
+        if (a->xcolumns[c].flag & COLUMN_FLAG_NAME)
+            a->xcolumns[c].name = a->string_table + offset;
+
+        if (a->xcolumns[c].flag & COLUMN_FLAG_DEFAULT) {
+            /* data is found relative to columns start */
+            a->xcolumns[c].offset = avio_tell(pb) - a->schema_offset;
+            avio_skip(pb, value_size);
+        }
+
+        if (a->xcolumns[c].flag & COLUMN_FLAG_ROW) {
+            /* data is found relative to row start */
+            a->xcolumns[c].offset = column_offset;
+            column_offset += value_size;
+        }
+    }
+
+    avio_seek(pb, a->strings_offset, SEEK_SET);
+    ret = avio_read(pb, a->string_table, a->strings_size);
+    if (ret != a->strings_size) {
+        if (ret < 0)
+            return ret;
+        return AVERROR(EIO);
+    }
+
+    for (int c = 0; c < a->columns; c++) {
+        int64_t data_offset = 0;
+        int64_t col_offset;
+        int flag, type;
+
+        if (strcmp(a->xcolumns[c].name, "data"))
+            continue;
+
+        type = a->xcolumns[c].type;
+        flag = a->xcolumns[c].flag;
+        col_offset = a->xcolumns[c].offset;
+
+        for (int r = 0; r < a->nb_segments; r++) {
+            if (flag & COLUMN_FLAG_DEFAULT) {
+                data_offset = a->schema_offset + col_offset;
+            } else if (flag & COLUMN_FLAG_ROW) {
+                data_offset = a->rows_offset + r * a->row_width + col_offset;
+            } else {
+                return AVERROR_INVALIDDATA;
+            }
+
+            avio_seek(pb, data_offset, SEEK_SET);
+            if (type == COLUMN_TYPE_VLDATA) {
+                a->segments[r].offset = avio_rb32(pb) + 0x58;
+                a->segments[r].size   = avio_rb32(pb);
+            } else {
+                return AVERROR_INVALIDDATA;
+            }
+        }
+    }
+
+    st = avformat_new_stream(s, NULL);
+    if (!st)
+        return AVERROR(ENOMEM);
+    par = s->streams[0]->codecpar;
+    par->codec_type = AVMEDIA_TYPE_AUDIO;
+
+    codec = a->string_table + a->name_offset;
+    if (!strcmp(codec, "AAX")) {
+        par->codec_id = AV_CODEC_ID_ADPCM_ADX;
+    } else if (!strcmp(codec, "HCA") ){
+        par->codec_id = AV_CODEC_ID_HCA;
+    } else {
+        return AVERROR_INVALIDDATA;
+    }
+
+    avio_seek(pb, a->segments[0].offset, SEEK_SET);
+    if (avio_rb16(pb) != 0x8000)
+        return AVERROR_INVALIDDATA;
+    extradata_size = avio_rb16(pb) + 4;
+    if (extradata_size < 12)
+        return AVERROR_INVALIDDATA;
+    avio_seek(pb, -4, SEEK_CUR);
+    ff_get_extradata(s, par, pb, extradata_size);
+    par->channels    = AV_RB8 (par->extradata + 7);
+    par->sample_rate = AV_RB32(par->extradata + 8);
+
+    avpriv_set_pts_info(st, 64, 32, par->sample_rate);
+
+    return 0;
+}
+
+static int aax_read_packet(AVFormatContext *s, AVPacket *pkt)
+{
+    AAXContext *a = s->priv_data;
+    AVCodecParameters *par = s->streams[0]->codecpar;
+    AVIOContext *pb = s->pb;
+    const int size = 18 * par->channels;
+    int ret, extradata_size = 0;
+    uint8_t *dst = NULL;
+
+    if (avio_feof(pb))
+        return AVERROR_EOF;
+
+    if (avio_tell(pb) >= a->segments[a->current_segment].offset +
+                         a->segments[a->current_segment].size) {
+        if (a->current_segment + 1 == a->nb_segments)
+            return AVERROR_EOF;
+        a->last_segment_pts = a->prev_pts;
+        a->current_segment++;
+        avio_seek(pb, a->segments[a->current_segment].offset, SEEK_SET);
+        if (avio_rb16(pb) != 0x8000)
+            return AVERROR_INVALIDDATA;
+        extradata_size = avio_rb16(pb) + 4;
+        avio_seek(pb, -4, SEEK_CUR);
+        if (extradata_size < 12)
+            return AVERROR_INVALIDDATA;
+        dst = av_packet_new_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, extradata_size);
+        if (!dst)
+            return AVERROR(ENOMEM);
+        avio_read(pb, dst, extradata_size);
+    }
+
+    pkt->pos = avio_tell(pb);
+    ret = av_get_packet(pb, pkt, size);
+    pkt->duration = 1;
+    pkt->stream_index = 0;
+    pkt->pts = a->last_segment_pts + ((pkt->pos - a->segments[a->current_segment].offset) / size);
+    a->prev_pts = pkt->pts;
+
+    if (dst) {
+        ret = av_packet_add_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, dst, extradata_size);
+        if (ret < 0)
+            return ret;
+    }
+
+    return ret;
+}
+
+AVInputFormat ff_aax_demuxer = {
+    .name           = "aax",
+    .long_name      = NULL_IF_CONFIG_SMALL("CRI AAX"),
+    .priv_data_size = sizeof(AAXContext),
+    .read_probe     = aax_probe,
+    .read_header    = aax_read_header,
+    .read_packet    = aax_read_packet,
+    .extensions     = "aax",
+    .flags          = AVFMT_GENERIC_INDEX,
+};
diff --git a/libavformat/allformats.c b/libavformat/allformats.c
index a23eb9e7fa..d3af6f7f18 100644
--- a/libavformat/allformats.c
+++ b/libavformat/allformats.c
@@ -31,6 +31,7 @@ 
 extern AVOutputFormat ff_a64_muxer;
 extern AVInputFormat  ff_aa_demuxer;
 extern AVInputFormat  ff_aac_demuxer;
+extern AVInputFormat  ff_aax_demuxer;
 extern AVInputFormat  ff_ac3_demuxer;
 extern AVOutputFormat ff_ac3_muxer;
 extern AVInputFormat  ff_acm_demuxer;