From patchwork Mon May 15 09:39:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Sebastian_Dr=C3=B6ge?= X-Patchwork-Id: 41624 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:ba91:b0:105:feb:71f2 with SMTP id fb17csp1477477pzb; Mon, 15 May 2023 02:40:06 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6KzzWel1a/n+/drOSYmG+o495B8cMfACAJQRS/nAXuZC+1nity79o9dWlS7HOz3xwD+JG2 X-Received: by 2002:a17:906:58d1:b0:96a:52e:5379 with SMTP id e17-20020a17090658d100b0096a052e5379mr18349888ejs.63.1684143605993; Mon, 15 May 2023 02:40:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684143605; cv=none; d=google.com; s=arc-20160816; b=0whGeAeBPC093dBM9uJHN3NT5uR2n2LaZQDW0kIJ4mjxVK2ROyBMcqw3F2D7wsdH3g cYr2o5d0jSNHyyjRsRfKY2d9WihwbKD/SuzvL+9GT5PgVlVZdnuf/GOKZTT8WATYpLpG 58/a7BXJi6ltBljIFta0jJrKqigGl0ietJQpLU0L2PiGLTUTOiorNvqNj74fk61RB8+Z HPXXRbMyuO0fTBYFBGs9qcThfwwYuwXmWrNy0NpO6q2Og0+SLJZ2yaIbv+iDsQ2mYtEL DaqEJF0dR2ZNzUscU3hEbw5jmi/lzpKU9q6KtgEksLX4DPyujvsxIoP+yedNca3n1mKs Dwqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:mime-version:message-id:date:to:from :dkim-signature:delivered-to; bh=h6sEEN+p75nDcgu5yi8E1Ew6+28w3edp9l4VcqUTuyw=; b=O0jIfSaECXTmzmaiXLFfmcPTQTGoN2/4/dq4JCuVFfHh5uq6wAgiT0fNw+2bCqHD5H AzkcpH6j5HbRiiFF6foe33CvAUXzfB3UgV+gkj5q2xNwjXdxqJpRBcFFlvXjOTwmvHEQ Om0w0axnFVyzzjWnlZVTLFrRzPcs7Yqa4l47/kD7qOYKbJb+tzawsDoutqiQESj9ST9T xA4yZyi5p2usQraAQlN9mSQ65hb5E4GxxtoMSg8eVrUwSTVaAwEaCOjnITPefuh4ATfn slxg54hoGnR6gosIfqOGTgxIHpl/n4993tT6shp1+zypuKjZr5thtObYqxeOE/mOUhPw 8FxA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@coaxion.net header.s=dkim header.b=kO5QXAKP; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=coaxion.net Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id e26-20020a50ec9a000000b0050bf820398asi11181237edr.371.2023.05.15.02.40.05; Mon, 15 May 2023 02:40:05 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@coaxion.net header.s=dkim header.b=kO5QXAKP; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=coaxion.net Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0DF5E68C05D; Mon, 15 May 2023 12:40:01 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail.coaxion.net (mail.coaxion.net [51.15.18.212]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id AA4C268BED3 for ; Mon, 15 May 2023 12:39:54 +0300 (EEST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id CB27CE2B716; Mon, 15 May 2023 11:39:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coaxion.net; s=dkim; t=1684143593; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding; bh=flZkANzKbXukJ32z8MysLeV0V8YbXW/DwuhYHwhgkgA=; b=kO5QXAKPGirEHP1nc67oTw1Z1v3RMr/frHDWWG+Zs3eq6neHYTikU16lkWOR7nSqWb48wL eI0+D5z2YFeylXiDFq0FbRNEreB6uwGNvjFigRU+1vW3kdK7UUB6JqqfENLrN5RI1qtWmz wyJXNoLmBixgMDo0/GFD0inPwBxqlG2M38y55AD5ceRwXh916td3KUk6Srll4FVcot4Xvu dzJGWUJ0zzNpF6D8n/trldaDqt6lQ1YvU02oASiWl4tFeXkjPS0z0Y08gjw4Q9Wp2Ttj5V /H41j6elXwRH+R2dsqRez6PXNt1DuvX411IlFVaXCW5o1HgejHyDPygx79JelA== From: =?utf-8?q?Sebastian_Dr=C3=B6ge?= To: ffmpeg-devel@ffmpeg.org Date: Mon, 15 May 2023 12:39:44 +0300 Message-Id: <20230515093944.623728-1-slomo@coaxion.net> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 Subject: [FFmpeg-devel] [PATCH] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: =?utf-8?q?Sebastian_Dr=C3=B6ge?= Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: MhfzRVx+OH9m From: Sebastian Dröge The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes. cdat contains EIA608 byte pairs for field 1, cdt2 for field 2. Previously any box following the first was treated as EIA608 byte pairs instead of parsing them correctly, and all data was handled as field 1. --- libavformat/mov.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 9fdeef057e..edd14701bf 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8868,22 +8868,40 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt) static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) { - int new_size, ret; + const uint32_t cdat_fourcc = AV_RL32("cdat"); + const uint32_t cdt2_fourcc = AV_RL32("cdt2"); + int new_size, write_size, ret; if (size <= 8) return AVERROR_INVALIDDATA; + new_size = ((size - 8) / 2) * 3; ret = av_new_packet(pkt, new_size); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + write_size = 0; + while (size > 8) { + uint32_t box_size = avio_rb32(pb); + uint32_t box_fourcc = avio_rl32(pb); + + if (box_size <= 8 || (box_size & 1) != 0 || box_size > size) + return AVERROR_INVALIDDATA; + if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) + return AVERROR_INVALIDDATA; + + for (int j = 8; j < box_size; j += 2) { + pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF; + pkt->data[write_size+1] = avio_r8(pb); + pkt->data[write_size+2] = avio_r8(pb); + } + + write_size += box_size; + size -= box_size; } + av_shrink_packet(pkt, write_size); + return 0; }