From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id D4AA24CF54 for ; Thu, 13 Feb 2025 21:01:52 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 538EF68C079; Thu, 13 Feb 2025 23:01:49 +0200 (EET) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id BD9BB68BE61 for ; Thu, 13 Feb 2025 23:01:42 +0200 (EET) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-21f7f1e1194so33919355ad.2 for ; Thu, 13 Feb 2025 13:01:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739480501; x=1740085301; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=unw2QFn5U5o4OAnD9F5EMat9aT0TPsUQrvgWbehtx0c=; b=bq06/CTcLdepqs7NUQ6pitYJrEAjTTTE0JCc79Klif56oyMyNfc5BMYdszOjsUHDiE 5Wu01eXOu4Wk1F8Mv91p2EUKYbXeu+cpfetumjvujp7FlbtCzVNfNS7DJ+v2vGMuWF87 S78qD64H0dPP7GyTu9aZdGPdrcHmzSQa+AWXkRdphAsw54WPm56tbxIEmAcu7BMnliId /mDY78aEYCyOMfeBD2GBn1jWwooNHOqhpMBthKqOCWTBkA4kkJCsD6+BdecyUQbbK59U T66oLMQyuvygpEZA2BmWnZT0KazkKyjo5cRjuPZQr3iBa3qxArUX5V/apk4vlVBVN1uh QBQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739480501; x=1740085301; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=unw2QFn5U5o4OAnD9F5EMat9aT0TPsUQrvgWbehtx0c=; b=xU+vBDsdr2gxnnecY/j3CNeekDyfn2W6/bK9UUvUPmFZv4YUQYUjDdLAB/6kcBKJqW KpeD57wwRF1CBqNa/G+D1jTrzCt6ZQ/lxf8hLiBoPzWn5MOL5ndPeOFjWTfC4tjd2P2m zli4jPm6376Y2wbkIoRouhYPd/buxnWfodTv94FyScCy/aZocPHSEW3lqENyNhaz66W/ +8flRKhtJl7juFqYj0ltTb5fzDV59LUxKZfC9C6oU7HT0gZP+mKOKTXYB+d2UoJ9FHT2 4gVo8+cgnborFpeZufAJTHL/u1OXfTs2zBOV40ZTb+S9gC7Utm7M39YhQNDIdkLfrOlt Kh7A== X-Gm-Message-State: AOJu0Yy9tGFtSFsZBNKfGdVz05RVn03yS/zPb4XPknlDrjJqsVQqNaGw woC03YTaKVNjUhkgadTMnD4T0Gx2aNgdxUBBmzfadynd/Hr6fgZC8x9sJQ== X-Gm-Gg: ASbGnctfNF/zrUovmN5xyXbENM1F0ua9uACiSrosH7/WWgmKPNV+lhGRgxA0npdzB9z E6Dp5iR8NULKsHpWKaGSmAZI83NjpbRFjKQwE7XmOXjYi2bYywy4BrfB7JkKtZ1UhhRQqwGv49K v+/Abxf/Z03YzFtg+BnFpW6SmiB8zqnsPUlVqrNzWr0qvMnlfZfi0mTJoicr6ZX8PHtmmrdaxKT V/P0ljLvOAVfMnNYHE+cIqVF1h2MFZHLBNvRLbHvI14vV/G3a53LBsR/Rw9LHKPxgDgtJrwmSMr csyjzEavOqpu1/qcuASGE34ksGhKdQ== X-Google-Smtp-Source: AGHT+IGPDbvcfFolZEo3ahZBnZN5MtS0LBO+G5T8NRSf++gXwWF/wUK4eGNQrlzwkaL67smmESGHHA== X-Received: by 2002:a05:6a00:8006:b0:72a:9ddf:55ab with SMTP id d2e1a72fcca58-7322c38b08emr12390231b3a.10.1739480500364; Thu, 13 Feb 2025 13:01:40 -0800 (PST) Received: from homestead.aragog.com ([2605:a601:a9a2:a100:67c:16ff:fe02:37f0]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-73242568146sm1719644b3a.47.2025.02.13.13.01.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Feb 2025 13:01:39 -0800 (PST) From: Pavel Koshevoy To: ffmpeg-devel@ffmpeg.org Date: Thu, 13 Feb 2025 14:01:38 -0700 Message-ID: <20250213210138.24103-1-pkoshevoy@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avformat/mov: (v3) fix get_eia608_packet X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Pavel Koshevoy Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The problem is reproducible with "Test for Quicktime 608 CC file.mov" from https://samples.ffmpeg.org/MPEG2/subcc/ ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov Prior to the fix QuickTime Player playback of remuxed.mov would render garbage text for "English CC" subtitles. --- libavformat/mov.c | 68 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 58 insertions(+), 10 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 85aef33b19..84165735f7 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10790,23 +10790,71 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt) static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) { - int new_size, ret; + /* We can't make assumptions about the structure of the payload, + because it may include multiple cdat and cdt2 samples. */ + const uint32_t cdat = AV_RB32("cdat"); + const uint32_t cdt2 = AV_RB32("cdt2"); + int ret, out_size = 0; + + /* a valid payload must have size, 4cc, and at least 1 byte pair: */ + if (size <= 10 || size % 2 != 0) + return AVERROR_INVALIDDATA; - if (size <= 8) + /* avoid an int overflow: */ + if ((size - 8) / 2 >= INT_MAX / 3) return AVERROR_INVALIDDATA; - new_size = ((size - 8) / 2) * 3; - ret = av_new_packet(pkt, new_size); + + ret = av_new_packet(pkt, ((size - 8) / 2) * 3); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + /* parse and re-format the c608 payload in one pass. */ + while (size >= 10) { + const uint32_t atom_size = avio_rb32(pb); + const uint32_t atom_type = avio_rb32(pb); + const int32_t data_size = atom_size - 8; + const uint8_t cc_field = + atom_type == cdat ? 1 : + atom_type == cdt2 ? 2 : + 0; + + /* account for bytes consumed for atom size and type. */ + size -= 8; + + /* make sure the atom size stays within the buffer boundaries. */ + if (data_size < 2 || data_size > size) { + ret = AVERROR_INVALIDDATA; + break; + } + + /* make sure the payload size is consistent with N byte pairs. */ + if (atom_size % 2 != 0) { + ret = AVERROR_INVALIDDATA; + break; + } + + if (!cc_field) { + /* neither cdat or cdt2 ... skip it */ + avio_skip(pb, data_size); + size -= data_size; + continue; + } + + for (int32_t i = 0; i < data_size; i += 2) { + pkt->data[out_size] = (0x1F << 3) | (1 << 2) | (cc_field - 1); + pkt->data[out_size + 1] = avio_r8(pb); + pkt->data[out_size + 2] = avio_r8(pb); + out_size += 3; + size -= 2; + } } - return 0; + if (size > 0) + /* skip any remaining unread portion of the input payload */ + avio_skip(pb, size); + + av_shrink_packet(pkt, out_size); + return ret; } static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *sample, -- 2.43.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".