From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 8354F4CF66 for ; Thu, 13 Feb 2025 21:22:22 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3CC1468C07C; Thu, 13 Feb 2025 23:22:18 +0200 (EET) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 183DB68BEF1 for ; Thu, 13 Feb 2025 23:22:12 +0200 (EET) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-220c8f38febso24196525ad.2 for ; Thu, 13 Feb 2025 13:22:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739481730; x=1740086530; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=38xrVeWFv4u+/a2e7RSja9fBR+1mzOsyxd5oam8T4tc=; b=GDCMiH4alRHM5ByuKBxxznhdtx3H7/p9TABB+UTRAERgGZKCLmf0Ya1JFRaKoyz76H SxsgzSdYiEGlhlp/Yu1fBE33W8JUFL6YxrBI0h/uu3pZp2ZnWWq71+fYBA2LW+JlQHRE M6TRK3bWUhYZgpXVxa+Z9xZ6jmHneb1uSnpjrS56vCReNTo0wtp4KDvpQwxbEu/ckL6R /K9dT+vHqjhLhL0bzxrFxvawRIrpGCxBK/d7C0ad/VkQtZnp4/TikZT71Uri1fy/RtGT gaCZtYRRpg+6vc9lijZUqiaAzp/bTnbIATtjj8m5sTwEYSQMSVoJlbleaEXwXmD1+gUF APAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739481730; x=1740086530; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=38xrVeWFv4u+/a2e7RSja9fBR+1mzOsyxd5oam8T4tc=; b=fhYzr4DU+2Lc8J8k0XZeUDBXGbHkRq5s4rOzsyJjasPxfmfLTvLU/4sOVTrliPTLoQ 5qnUAgNukM14wH5xw+bkL4/wgZdrwQfMmQgVCD25Ie3fWmhbhnj6dKzXjyodxDQ33y43 7g+GX+qPbWWr7HKOfwydicL0+Kv2a4ryuGCCZ/bxFyUmSLWgCbJTqsIx1TxEEoawoP5z bLjgSnHL6qbSAyxYXcoSYbOaOMZY11MraNaCqqIb4jVOsQXrA/7XUTvfgUizpMKcGnkc J1gJjZGI1BDuBbuWvPeSehpQPHyQSMy7TVymJ4vnT/6WjJAeRjPgHd+NGlfMOa63FCd4 VShQ== X-Gm-Message-State: AOJu0Yzh5T1Sw/uL+0S09iR8aRN30YogHg7uNEF8CtyLYN4Ki1fbIFat 9otUxIE0RTw/vJy7TzRCQn5gjA6lsyROhFlbESWNAPaQcfgtmnmvlm9GAg== X-Gm-Gg: ASbGncs2t/uKH1UdmaY5KoNItGopBjlxC+DScLUevgma2VFT5SsNGFu3m5GRtyLppiU O7/jTNI/zBQR3GZLSvioDYlBkfqz+tSVhzotn09+imOyZ/iVCr26E4/qBYm6Ds5edVEsfYO0c4R X+WZM/11kDg6lQYkq8axjyYOxvUuzaTG5k/aEMTX6D+cDumutj4WMkkuz37bd67R0PWtKZl8KED RPL2qXIafdaO2LGEiMvU0sjfy0eEoVsihyben1tLN18UR+JI0yPaRJQnpK7EGFIXswiSzUy4tM2 wo5kcnJVkz5PVGnvL7Y4feS84WKXCA== X-Google-Smtp-Source: AGHT+IGBQQP2ugYpbSlOVu9ZldV/o+vfXuX8zD/gfDd/HYeIACyDlIHfOz7M2RbPWm/T+JbjjYRW0g== X-Received: by 2002:a17:903:2b05:b0:21f:4b01:b985 with SMTP id d9443c01a7336-220be007160mr134430115ad.45.1739481730201; Thu, 13 Feb 2025 13:22:10 -0800 (PST) Received: from homestead.aragog.com ([2605:a601:a9a2:a100:67c:16ff:fe02:37f0]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-220d5349a36sm17011915ad.17.2025.02.13.13.22.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Feb 2025 13:22:09 -0800 (PST) From: Pavel Koshevoy To: ffmpeg-devel@ffmpeg.org Date: Thu, 13 Feb 2025 14:22:08 -0700 Message-ID: <20250213212208.29414-1-pkoshevoy@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avformat/mov: (v4) fix get_eia608_packet X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Pavel Koshevoy Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The problem is reproducible with "Test for Quicktime 608 CC file.mov" from https://samples.ffmpeg.org/MPEG2/subcc/ ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov Prior to the fix QuickTime Player playback of remuxed.mov would render garbage text for "English CC" subtitles. --- libavformat/mov.c | 70 +++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 11 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 85aef33b19..5a91ef5b8c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10788,25 +10788,73 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt) return 0; } -static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) +static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int src_size) { - int new_size, ret; + /* We can't make assumptions about the structure of the payload, + because it may include multiple cdat and cdt2 samples. */ + const uint32_t cdat = AV_RB32("cdat"); + const uint32_t cdt2 = AV_RB32("cdt2"); + int ret, out_size = 0; - if (size <= 8) + /* a valid payload must have size, 4cc, and at least 1 byte pair: */ + if (src_size < 10) return AVERROR_INVALIDDATA; - new_size = ((size - 8) / 2) * 3; - ret = av_new_packet(pkt, new_size); + + /* avoid an int overflow: */ + if ((src_size - 8) / 2 >= INT_MAX / 3) + return AVERROR_INVALIDDATA; + + ret = av_new_packet(pkt, ((src_size - 8) / 2) * 3); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + /* parse and re-format the c608 payload in one pass. */ + while (src_size >= 10) { + const uint32_t atom_size = avio_rb32(pb); + const uint32_t atom_type = avio_rb32(pb); + const uint32_t data_size = atom_size - 8; + const uint8_t cc_field = + atom_type == cdat ? 1 : + atom_type == cdt2 ? 2 : + 0; + + /* account for bytes consumed for atom size and type. */ + src_size -= 8; + + /* make sure the data size stays within the buffer boundaries. */ + if (data_size < 2 || data_size > src_size) { + ret = AVERROR_INVALIDDATA; + break; + } + + /* make sure the data size is consistent with N byte pairs. */ + if (data_size % 2 != 0) { + ret = AVERROR_INVALIDDATA; + break; + } + + if (!cc_field) { + /* neither cdat or cdt2 ... skip it */ + avio_skip(pb, data_size); + src_size -= data_size; + continue; + } + + for (int32_t i = 0; i < data_size; i += 2) { + pkt->data[out_size] = (0x1F << 3) | (1 << 2) | (cc_field - 1); + pkt->data[out_size + 1] = avio_r8(pb); + pkt->data[out_size + 2] = avio_r8(pb); + out_size += 3; + src_size -= 2; + } } - return 0; + if (src_size > 0) + /* skip any remaining unread portion of the input payload */ + avio_skip(pb, src_size); + + av_shrink_packet(pkt, out_size); + return ret; } static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *sample, -- 2.43.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".