From patchwork Wed Jun 7 12:09:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Sebastian_Dr=C3=B6ge?= X-Patchwork-Id: 41989 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:c526:b0:117:ac03:c9de with SMTP id gm38csp347508pzb; Wed, 7 Jun 2023 05:10:52 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5Da50tqHAkKdIUj9frAqeoYwcC6c8SO9CyPLjgU4qieajyYzVRG4+IRGhuZ1JUreRwOvTP X-Received: by 2002:a17:907:94d1:b0:977:e2a6:47ce with SMTP id dn17-20020a17090794d100b00977e2a647cemr6807977ejc.35.1686139851953; Wed, 07 Jun 2023 05:10:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686139851; cv=none; d=google.com; s=arc-20160816; b=j0BLfkNjXbRo0M22uH3ERpM5dcVKS35tcvxVJJ4TFHpLychufi6j8Fr3OcZ2pqKGyy 2Oy7freVg8YOhXzzJ4m0rbEciLiu2gRrcEBxyKfulAem4SenbBfv+/ux+emjZYAGpe9Z BIrahmPVq81AjBa7TIsfEDTgUC2MqFOS4EtQgu+g37gdCZIjcb41SnS5dSHkyqC7BHzX 8E1WmqpiNr3G21XzzonuxGRyfq1xZwEHexK/v/sVoMQjOFESfvTYE7uW4L7+d5UtnL0e SUg+Ulyxzp0jJdpp6zRs9F1qqUR7rHQbVbIiAbI0nYQ8wYvIzdZvHv+v9+4VZTRwpUbh JxSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:mime-version:references:in-reply-to :message-id:date:to:from:dkim-signature:delivered-to; bh=QNFJS4NU77izxcLMzJKsbQ09MyV5QE6C5ZOErNWTRPk=; b=Fa+nvaC5D9uyrpBhKmXYU3SPNdZGCKPOKQYqC9rZDmxEj6DrVzHIlSwV2SJ0ce8Yjt t1b+7No+zj5xI2ZvKTrFNlgS5Lvx8Nno3YNLPnHP+FgD2i9r7+Ymo5wbdFg3rJVT8JFT zfjsSHOeU+12pbQvmk3YVw6rOABtklhZY4V13Jr2qHKbGyIPKsvUjTERh6QvZCoBQMqC 6AgBKA9on8m6AKXvn7/gRsknPGejLYUrMCO846Cml0IKtYNy7GC2nilpjtWIoXg0YS5F uHcxd6oJwB0mxGAkxUay6JZ9/gYL5KHv/6ayzv/Wiz0/ULbAmwU1Zdd7n0r3XyE9k++T FoAA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@coaxion.net header.s=dkim header.b=ak2WZ9BF; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=coaxion.net Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id re10-20020a170906d8ca00b00977e10fafd3si3906364ejb.1045.2023.06.07.05.10.50; Wed, 07 Jun 2023 05:10:51 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@coaxion.net header.s=dkim header.b=ak2WZ9BF; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=coaxion.net Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7CA8968C2BB; Wed, 7 Jun 2023 15:10:46 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail.coaxion.net (mail.coaxion.net [51.15.18.212]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 12917689B0B for ; Wed, 7 Jun 2023 15:10:39 +0300 (EEST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 88D74E202CA; Wed, 7 Jun 2023 14:10:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coaxion.net; s=dkim; t=1686139838; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=Isv86pSY+aTjHTj19e84rdMZhJaA+KimunlHB/HTb7U=; b=ak2WZ9BFAauBxTpJUxujdAlsBh7gKs2O+MLd3CenrC6voq/NgGNN+PWzJcGcgKsrq9dmzU 5DYHBnbCjAgFKzqiMM8s78Lfk4L49fsMyXhpnMJ1dAH2CeOhDkDDyedZb/Z5E2XNIkWY7U UmXyoWx1t7XoPV6oSKxaL2oHD+FP1g4JczweE3ZiNaw+Zuvoezj2F2nNLgUec/kZu45yVl LD+thm9/B6RaaWzFXE/nlhKt1KDu4zreNOhfElHgILjZ7JFIVY3SlIWDLfJnGiaZej/+Ks UA1tOBgvW28/+vRYAwahKWqv9+tUox1+51IMNz+rQHQd8y4gC/U31UDstTg/fg== From: =?utf-8?q?Sebastian_Dr=C3=B6ge?= To: ffmpeg-devel@ffmpeg.org Date: Wed, 7 Jun 2023 15:09:33 +0300 Message-Id: <20230607120933.776663-1-slomo@coaxion.net> In-Reply-To: <20230515093944.623728-1-slomo@coaxion.net> References: <20230515093944.623728-1-slomo@coaxion.net> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 Subject: [FFmpeg-devel] [PATCH v2] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: =?utf-8?q?Sebastian_Dr=C3=B6ge?= Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: blHFIEft39Lg From: Sebastian Dröge The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes. cdat contains EIA608 byte pairs for field 1, cdt2 for field 2. Previously any box following the first was treated as EIA608 byte pairs instead of parsing them correctly, and all data was handled as field 1. --- Changes compared to v1: - Skip over unknown boxes instead of erroring out, as required by the spec. - Calculate write_size correctly. libavformat/mov.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 9fdeef057e..341b42228d 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8868,22 +8868,43 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt) static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) { - int new_size, ret; + const uint32_t cdat_fourcc = AV_RL32("cdat"); + const uint32_t cdt2_fourcc = AV_RL32("cdt2"); + int new_size, write_size, ret; if (size <= 8) return AVERROR_INVALIDDATA; + new_size = ((size - 8) / 2) * 3; ret = av_new_packet(pkt, new_size); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + write_size = 0; + while (size > 8) { + uint32_t box_size = avio_rb32(pb); + uint32_t box_fourcc = avio_rl32(pb); + + if (box_size <= 8 || (box_size & 1) != 0 || box_size > size) + return AVERROR_INVALIDDATA; + if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) { + avio_skip(pb, box_size - 8); + size -= box_size; + continue; + } + + for (int j = 8; j < box_size; j += 2) { + pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF; + pkt->data[write_size+1] = avio_r8(pb); + pkt->data[write_size+2] = avio_r8(pb); + write_size += 3; + } + + size -= box_size; } + av_shrink_packet(pkt, write_size); + return 0; }