@@ -8868,22 +8868,43 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
{
- int new_size, ret;
+ const uint32_t cdat_fourcc = AV_RL32("cdat");
+ const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+ int new_size, write_size, ret;
if (size <= 8)
return AVERROR_INVALIDDATA;
+
new_size = ((size - 8) / 2) * 3;
ret = av_new_packet(pkt, new_size);
if (ret < 0)
return ret;
- avio_skip(pb, 8);
- for (int j = 0; j < new_size; j += 3) {
- pkt->data[j] = 0xFC;
- pkt->data[j+1] = avio_r8(pb);
- pkt->data[j+2] = avio_r8(pb);
+ write_size = 0;
+ while (size > 8) {
+ uint32_t box_size = avio_rb32(pb);
+ uint32_t box_fourcc = avio_rl32(pb);
+
+ if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+ return AVERROR_INVALIDDATA;
+ if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) {
+ avio_skip(pb, box_size - 8);
+ size -= box_size;
+ continue;
+ }
+
+ for (int j = 8; j < box_size; j += 2) {
+ pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFD;
+ pkt->data[write_size+1] = avio_r8(pb);
+ pkt->data[write_size+2] = avio_r8(pb);
+ write_size += 3;
+ }
+
+ size -= box_size;
}
+ av_shrink_packet(pkt, write_size);
+
return 0;
}
From: Sebastian Dröge <sebastian@centricular.com> The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes. cdat contains EIA608 byte pairs for field 1, cdt2 for field 2. Previously any box following the first was treated as EIA608 byte pairs instead of parsing them correctly, and all data was handled as field 1. --- Changes compared to v2: - Use 0xFD instead of 0xFF for field 2. Thanks to Devin Heitmueller for noticing that typo. libavformat/mov.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-)