From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 46DBA4CF2A for ; Thu, 13 Feb 2025 17:55:22 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2DFD068C07A; Thu, 13 Feb 2025 19:55:19 +0200 (EET) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 1B2AC68BC23 for ; Thu, 13 Feb 2025 19:55:13 +0200 (EET) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-220c8f38febso21267275ad.2 for ; Thu, 13 Feb 2025 09:55:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739469311; x=1740074111; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=a+bL/FpD2jEG2MBSEjNMhquCxP4Sd8Xk5+Aeee20Ysg=; b=mlM3BHtPbF40G5bjJEjPVK/L7WJkQ0NoBsw9SfEmY3tiQKgHePBl0Mu2DmDIHDjdTU 4ly+Z3O4Pd1SAfHTtSrowICo/NwkO4Ap42PG9tljiSng/2usqbtfJF/ZQ4//9yZUXpjm X/+GD/us2bt1LBmUpz7OQfMkriyehA9uvJ5z6eoYh3Bgg46/j3v6YREVI/xsrkKcZtqK c0gkeADZVTcDmAYEOZX4kavydpGzXrFGlLEaBzjNW4J77rYRSqtsmo+MV8vWyUGkB5z4 XygKgh7FdC+OeTJsrh7814PHKON7gzyjAbGEJi8UmBhA+hJbL1CoVnptPj6b3YQS+ALY /ANQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739469311; x=1740074111; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=a+bL/FpD2jEG2MBSEjNMhquCxP4Sd8Xk5+Aeee20Ysg=; b=ONTuYRBGo+eh05tlzZdKIJRvX3I3b8Umyc+fEfASreqm79Asip5ZWdF0thkB4PRGWJ pQzDULv5nKHIhtR3VTdKyr72ABshMTWkWmJHe3XSGL+k7BUkPFB/FLVR62ayybtd647w YR7J93pq41ihvnkQafh8tNm04M2oblDD51LnOiiUjaaYXSTxgC8QUOCeZvC1/3HTHimW VvVUUuoa9lrjSlI7mWzubfUYJjl9VDXhN580hmOFmxI4GDWCvsD+9d7l2syAXhpWjbgu dc/mOfaXzy4Hc9MgBBUOWo3yAks+Whmzf0GX/3+q8JTzAr7FQnk2GswVLZ9Wh3Lalnc+ /lKA== X-Gm-Message-State: AOJu0YzjiFEgMRL9B9bBeRxH/p9f75BCyMsmwVMz/rmzLC4Q1DGTJaEh O0zDUvYO/+7kdHeCWrC9w/2N2HUBgB+c8Y6Jr6I0SPAp1hzeORfgkMu9Aw== X-Gm-Gg: ASbGncuOvxsFCY3IkSEY7SptPPjLMz0DQ0d8fgfLUqRmdqZUJLyiwt5PrzXmskt6LoZ 74zeUknTuOfCR7tPSNmi3yzmtVW0pUb1Pxjy2x9csxAAD/9OPvZKm50OQ25uKkNGCI8kSJAd6Ux VMnWZ4x4KL0vqgKSVeIFzTh6AvVzL08QQHa47DAFbPIf5oSu5xfEiUy0vZpB+Y/HTNT6277W32+ +oXuQtOOByiHW5oECv42PrY3WdFrqPi8szfUGupZ4H1uaRPxcD+EjtQo3F44J9DuxMcXcjkZ5m3 suyKS3mxZH7bGn2YL6a/+NyW7Ry07A== X-Google-Smtp-Source: AGHT+IE6WV2vXZaKVmBpEP6fp5BG1oQbGSllhdNAa4gu0FrPvl/K4hFr6bPCT3DQCyEyPdG0YcBbJg== X-Received: by 2002:a05:6a00:1705:b0:727:3fd5:b530 with SMTP id d2e1a72fcca58-7322c5fdd4bmr12089487b3a.15.1739469310884; Thu, 13 Feb 2025 09:55:10 -0800 (PST) Received: from homestead.aragog.com ([2605:a601:a9a2:a100:67c:16ff:fe02:37f0]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7324273e3c3sm1595204b3a.92.2025.02.13.09.55.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Feb 2025 09:55:10 -0800 (PST) From: Pavel Koshevoy To: ffmpeg-devel@ffmpeg.org Date: Thu, 13 Feb 2025 10:55:09 -0700 Message-ID: <20250213175509.13909-1-pkoshevoy@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avformat/mov: (v2) fix get_eia608_packet X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Pavel Koshevoy Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The problem is reproducible with "Test for Quicktime 608 CC file.mov" from https://samples.ffmpeg.org/MPEG2/subcc/ ffmpeg_g -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov Prior to the fix QuickTime Player playback of remuxed.mov would render cdt2 atom type tags as part of "English CC" subtitles. --- libavformat/mov.c | 54 +++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 45 insertions(+), 9 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 85aef33b19..65b4f3dd5c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10790,22 +10790,58 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt) static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) { - int new_size, ret; + /* We can't make assumptions about the structure of the payload, + because it may include multiple cdat and cdt2 samples. */ + int ret, out_size_max, out_size = 0; - if (size <= 8) + /* a valide payload must have size, 4cc, and at least 1 byte pair: */ + if (size <= 10 || size % 2 != 0) return AVERROR_INVALIDDATA; - new_size = ((size - 8) / 2) * 3; - ret = av_new_packet(pkt, new_size); + + /* avoid an int overflow: */ + if ((size - 8) / 2 >= (INT_MAX - size) / 3) + return AVERROR_INVALIDDATA; + + /* Allocate the buffer larger enough to store the output cc_data_pkts + and the original c608 payload, safely. */ + out_size_max = ((size - 8) / 2) * 3; + ret = av_new_packet(pkt, out_size_max + size); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + /* Load the original c608 payload into the last 3rd of the buffer. */ + if (avio_read(pb, pkt->data + out_size_max, size) != size) + return AVERROR_EOF; + + /* parse and re-format the c608 payload in one pass. */ + for (uint8_t *out = pkt->data, *src = out + out_size_max, *end = src + size; src + 8 <= end; ) { + uint32_t atom_size = AV_RB32(src); + uint8_t cc_field = + memcmp(src + 4, "cdat", 4) == 0 ? 1 : + memcmp(src + 4, "cdt2", 4) == 0 ? 2 : + 0; + + /* make sure the atom size stays within the buffer boundaries. */ + if (src + atom_size > end) + return AVERROR_INVALIDDATA; + + /* make sure the payload size is consistent with N byte pairs. */ + if ((atom_size - 8) % 2 != 0) + return AVERROR_INVALIDDATA; + + if (cc_field != 0) { + for (uint8_t *cc = src + 8, *cc_end = src + atom_size; cc < cc_end; cc += 2) { + out[0] = (0x1F << 3) | (1 << 2) | (cc_field - 1); + out[1] = cc[0]; + out[2] = cc[1]; + out_size += 3; + out += 3; + } + } + src += atom_size; } + av_shrink_packet(pkt, out_size); return 0; } -- 2.43.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".