[FFmpeg-devel] [PATCH] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[FFmpeg-devel] [PATCH] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[Sebastian Dröge]

From: Sebastian Dröge <sebastian@centricular.com>

The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes.
cdat contains EIA608 byte pairs for field 1, cdt2 for field 2.

Previously any box following the first was treated as EIA608 byte pairs
instead of parsing them correctly, and all data was handled as field 1.
---
 libavformat/mov.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9fdeef057e..edd14701bf 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8868,22 +8868,40 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
 
 static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
 {
-    int new_size, ret;
+    const uint32_t cdat_fourcc = AV_RL32("cdat");
+    const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+    int new_size, write_size, ret;
 
     if (size <= 8)
         return AVERROR_INVALIDDATA;
+
     new_size = ((size - 8) / 2) * 3;
     ret = av_new_packet(pkt, new_size);
     if (ret < 0)
         return ret;
 
-    avio_skip(pb, 8);
-    for (int j = 0; j < new_size; j += 3) {
-        pkt->data[j] = 0xFC;
-        pkt->data[j+1] = avio_r8(pb);
-        pkt->data[j+2] = avio_r8(pb);
+    write_size = 0;
+    while (size > 8) {
+      uint32_t box_size = avio_rb32(pb);
+      uint32_t box_fourcc = avio_rl32(pb);
+
+      if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+        return AVERROR_INVALIDDATA;
+      if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc)
+        return AVERROR_INVALIDDATA;
+
+      for (int j = 8; j < box_size; j += 2) {
+          pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF;
+          pkt->data[write_size+1] = avio_r8(pb);
+          pkt->data[write_size+2] = avio_r8(pb);
+      }
+
+      write_size += box_size;
+      size -= box_size;
     }
 
+    av_shrink_packet(pkt, write_size);
+
     return 0;
 }
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH v2] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[Sebastian Dröge]

From: Sebastian Dröge <sebastian@centricular.com>

The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes.
cdat contains EIA608 byte pairs for field 1, cdt2 for field 2.

Previously any box following the first was treated as EIA608 byte pairs
instead of parsing them correctly, and all data was handled as field 1.
---

Changes compared to v1:
  - Skip over unknown boxes instead of erroring out, as required by the spec.
  - Calculate write_size correctly.

 libavformat/mov.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9fdeef057e..341b42228d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8868,22 +8868,43 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
 
 static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
 {
-    int new_size, ret;
+    const uint32_t cdat_fourcc = AV_RL32("cdat");
+    const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+    int new_size, write_size, ret;
 
     if (size <= 8)
         return AVERROR_INVALIDDATA;
+
     new_size = ((size - 8) / 2) * 3;
     ret = av_new_packet(pkt, new_size);
     if (ret < 0)
         return ret;
 
-    avio_skip(pb, 8);
-    for (int j = 0; j < new_size; j += 3) {
-        pkt->data[j] = 0xFC;
-        pkt->data[j+1] = avio_r8(pb);
-        pkt->data[j+2] = avio_r8(pb);
+    write_size = 0;
+    while (size > 8) {
+      uint32_t box_size = avio_rb32(pb);
+      uint32_t box_fourcc = avio_rl32(pb);
+
+      if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+        return AVERROR_INVALIDDATA;
+      if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) {
+        avio_skip(pb, box_size - 8);
+        size -= box_size;
+        continue;
+      }
+
+      for (int j = 8; j < box_size; j += 2) {
+          pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF;
+          pkt->data[write_size+1] = avio_r8(pb);
+          pkt->data[write_size+2] = avio_r8(pb);
+          write_size += 3;
+      }
+
+      size -= box_size;
     }
 
+    av_shrink_packet(pkt, write_size);
+
     return 0;
 }
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH v3] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[Sebastian Dröge]

From: Sebastian Dröge <sebastian@centricular.com>

The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes.
cdat contains EIA608 byte pairs for field 1, cdt2 for field 2.

Previously any box following the first was treated as EIA608 byte pairs
instead of parsing them correctly, and all data was handled as field 1.
---

Changes compared to v2:
  - Use 0xFD instead of 0xFF for field 2. Thanks to Devin Heitmueller for
    noticing that typo.

 libavformat/mov.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9fdeef057e..4c79fc8857 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8868,22 +8868,43 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
 
 static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
 {
-    int new_size, ret;
+    const uint32_t cdat_fourcc = AV_RL32("cdat");
+    const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+    int new_size, write_size, ret;
 
     if (size <= 8)
         return AVERROR_INVALIDDATA;
+
     new_size = ((size - 8) / 2) * 3;
     ret = av_new_packet(pkt, new_size);
     if (ret < 0)
         return ret;
 
-    avio_skip(pb, 8);
-    for (int j = 0; j < new_size; j += 3) {
-        pkt->data[j] = 0xFC;
-        pkt->data[j+1] = avio_r8(pb);
-        pkt->data[j+2] = avio_r8(pb);
+    write_size = 0;
+    while (size > 8) {
+      uint32_t box_size = avio_rb32(pb);
+      uint32_t box_fourcc = avio_rl32(pb);
+
+      if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+        return AVERROR_INVALIDDATA;
+      if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) {
+        avio_skip(pb, box_size - 8);
+        size -= box_size;
+        continue;
+      }
+
+      for (int j = 8; j < box_size; j += 2) {
+          pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFD;
+          pkt->data[write_size+1] = avio_r8(pb);
+          pkt->data[write_size+2] = avio_r8(pb);
+          write_size += 3;
+      }
+
+      size -= box_size;
     }
 
+    av_shrink_packet(pkt, write_size);
+
     return 0;
 }
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".