Re: [FFmpeg-devel] [PATCH v3] decklink: Add support for compressed AC-3 output over SDI

[Marton Balint <cus@passwd.hu>]

On Mon, 27 Mar 2023, Devin Heitmueller wrote:

> +static int create_s337_payload(AVPacket *pkt, enum AVCodecID codec_id, uint8_t **outbuf, int *outsize)
> +{
> +    int payload_size = pkt->size + 8;
> +    uint16_t bitcount = pkt->size * 8;
> +    uint8_t *s337_payload;
> +    PutByteContext pb;
> +
> +    if (codec_id != AV_CODEC_ID_AC3)
> +        return AVERROR(EINVAL);

The codec check might be overkill here, after all you are calling this 
only from code which already checked this. Or later you extend this 
somehow?

> +
> +    /* Sanity check:  According to SMPTE ST 340:2015 Sec 4.1, the AC-3 sync frame will
> +       exactly match the 1536 samples of baseband (PCM) audio that it represents.  */
> +    if (pkt->size > 1536)
> +        return AVERROR(EINVAL);
> +
> +    /* Encapsulate AC3 syncframe into SMPTE 337 packet */
> +    s337_payload = (uint8_t *) av_malloc(payload_size);
> +    if (s337_payload == NULL)
> +        return AVERROR(ENOMEM);
> +    bytestream2_init_writer(&pb, s337_payload, payload_size);
> +    bytestream2_put_le16u(&pb, 0xf872); /* Sync word 1 */
> +    bytestream2_put_le16u(&pb, 0x4e1f); /* Sync word 1 */
> +    bytestream2_put_le16u(&pb, 0x0001); /* Burst Info, including data type (1=ac3) */
> +    bytestream2_put_le16u(&pb, bitcount); /* Length code */
> +    for (int i = 0; i < pkt->size; i += 2)
> +        bytestream2_put_le16u(&pb, (pkt->data[i] << 8) | pkt->data[i+1]);

This can overread/ovewrite 1 byte if pkt->size is odd.

Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".