March 2021 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Mar 20 14:36:28 2021 +0100| [ceae92cb291c2536a93482cdf3c1ae3f7330b924] | committer: Michael Niedermayer avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context() Fixes: crash Fixes: check_pkt.mp4 Found-by: Rafael Dutra <rafael.dutra(a)cispa.de> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ceae92cb291c2536a… --- libavcodec/h264_slice.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 84b5710ab4..62f7a61aed 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -304,9 +304,8 @@ int ff_h264_update_thread_context(AVCodecContext *dst, if (dst == src) return 0; - // We can't fail if SPS isn't set at it breaks current skip_frame code - //if (!h1->ps.sps) - // return AVERROR_INVALIDDATA; + if (inited && !h1->ps.sps) + return AVERROR_INVALIDDATA; if (inited && (h->width != h1->width ||

1 0

avcodec/mpegpicture: Keep ff_mpeg_framesize_alloc() failure state consistent
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Mar 18 19:19:54 2021 +0100| [76cea1d2ce3f23e8131c8664086a1daf873ed694] | committer: Michael Niedermayer avcodec/mpegpicture: Keep ff_mpeg_framesize_alloc() failure state consistent Fixes: null pointer dereference Fixes: ff_put_pixels16_sse2.mp4 Found-by: Rafael Dutra <rafael.dutra(a)cispa.de> Regression-since: 4b2863ff01b1fe93d9a518523c9098d17a9d8c6f Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=76cea1d2ce3f23e81… --- libavcodec/mpegpicture.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/mpegpicture.c b/libavcodec/mpegpicture.c index e3f648895d..0652b7c879 100644 --- a/libavcodec/mpegpicture.c +++ b/libavcodec/mpegpicture.c @@ -79,8 +79,11 @@ int ff_mpeg_framesize_alloc(AVCodecContext *avctx, MotionEstContext *me, // linesize * interlaced * MBsize // we also use this buffer for encoding in encode_mb_internal() needig an additional 32 lines if (!FF_ALLOCZ_TYPED_ARRAY(sc->edge_emu_buffer, alloc_size * EMU_EDGE_HEIGHT) || - !FF_ALLOCZ_TYPED_ARRAY(me->scratchpad, alloc_size * 4 * 16 * 2)) + !FF_ALLOCZ_TYPED_ARRAY(me->scratchpad, alloc_size * 4 * 16 * 2)) { + av_freep(&sc->edge_emu_buffer); return AVERROR(ENOMEM); + } + me->temp = me->scratchpad; sc->rd_scratchpad = me->scratchpad; sc->b_scratchpad = me->scratchpad;

1 0

avformat/mpc8: check for size overflow in mpc8_get_chunk_header()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Mar 17 21:58:53 2021 +0100| [6cc65d3d6760cfb08c5a9e57d4306d88428e18d0] | committer: Michael Niedermayer avformat/mpc8: check for size overflow in mpc8_get_chunk_header() Fixes: signed integer overflow: -9223372036854775760 - 50 cannot be represented in type 'long' Fixes: 31673/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-580134751869337 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6cc65d3d6760cfb08… --- libavformat/mpc8.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c index ff7da2ef55..b12a417f63 100644 --- a/libavformat/mpc8.c +++ b/libavformat/mpc8.c @@ -127,7 +127,11 @@ static void mpc8_get_chunk_header(AVIOContext *pb, int *tag, int64_t *size) pos = avio_tell(pb); *tag = avio_rl16(pb); *size = ffio_read_varlen(pb); - *size -= avio_tell(pb) - pos; + pos -= avio_tell(pb); + if (av_sat_add64(*size, pos) != (uint64_t)*size + pos) { + *size = -1; + } else + *size += pos; } static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)

1 0

avformat/mov: Do not zero memory that is written too or unused
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Mar 21 18:08:43 2021 +0100| [c1fe1114bc4c2f6da764f0eca792cf03c82c3422] | committer: Michael Niedermayer avformat/mov: Do not zero memory that is written too or unused Fixes: OOM Fixes: 31220/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6033383962574848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c1fe1114bc4c2f6da… --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index f4c2215ba4..a1411264ec 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3022,7 +3022,7 @@ static int mov_read_sdtp(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_freep(&sc->sdtp_data); sc->sdtp_count = 0; - sc->sdtp_data = av_mallocz(entries); + sc->sdtp_data = av_malloc(entries); if (!sc->sdtp_data) return AVERROR(ENOMEM);

1 0

avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Mar 22 15:22:35 2021 +0100| [87d87e6587deec1fa8ed5f5c6901535becdb0358] | committer: Michael Niedermayer avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change() Fixes: out of array access Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=87d87e6587deec1fa… --- libavcodec/mpegvideo.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 988dd18a33..728e591958 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -1069,6 +1069,13 @@ int ff_mpv_common_frame_size_change(MpegEncContext *s) (err = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0) return err; + /* set chroma shifts */ + err = av_pix_fmt_get_chroma_sub_sample(s->avctx->pix_fmt, + &s->chroma_x_shift, + &s->chroma_y_shift); + if (err < 0) + return err; + if ((err = init_context_frame(s))) return err;

1 0

avformat/mov: Ignore multiple STSC / STCO
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Mar 24 17:03:08 2021 +0100| [2611d20d353026f996cb9aaced8b35db37f490d4] | committer: Michael Niedermayer avformat/mov: Ignore multiple STSC / STCO Fixes: STSC / STCO inconsistency and assertion failure Fixes: crbug1184666.mp4 Found-by: Chromium ASAN fuzzer Reviewed-by: Matt Wolenetz <wolenetz(a)google.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2611d20d353026f99… --- libavformat/mov.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index cb818ebe0e..f4c2215ba4 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2037,8 +2037,10 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!entries) return 0; - if (sc->chunk_offsets) - av_log(c->fc, AV_LOG_WARNING, "Duplicated STCO atom\n"); + if (sc->chunk_offsets) { + av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicated STCO atom\n"); + return 0; + } av_free(sc->chunk_offsets); sc->chunk_count = 0; sc->chunk_offsets = av_malloc_array(entries, sizeof(*sc->chunk_offsets)); @@ -2671,8 +2673,10 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!entries) return 0; - if (sc->stsc_data) - av_log(c->fc, AV_LOG_WARNING, "Duplicated STSC atom\n"); + if (sc->stsc_data) { + av_log(c->fc, AV_LOG_WARNING, "Ignoring duplicated STSC atom\n"); + return 0; + } av_free(sc->stsc_data); sc->stsc_count = 0; sc->stsc_data = av_malloc_array(entries, sizeof(*sc->stsc_data));

1 0

avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Feb 2 17:29:23 2021 +0100| [b37ff29e0e093b15585e9fb44bbd82bdf14b5230] | committer: Michael Niedermayer avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields() Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long' Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b37ff29e0e093b155… --- libavformat/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index dffc259ed8..92695c3f2b 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1275,7 +1275,7 @@ static void compute_pkt_fields(AVFormatContext *s, AVStream *st, presentation_delayed = 1; if (pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE && - st->pts_wrap_bits < 63 && pkt->dts > INT64_MIN + (1LL << (st->pts_wrap_bits - 1)) && + st->pts_wrap_bits < 63 && pkt->dts > INT64_MIN + (1LL << st->pts_wrap_bits) && pkt->dts - (1LL << (st->pts_wrap_bits - 1)) > pkt->pts) { if (is_relative(st->cur_dts) || pkt->dts - (1LL<<(st->pts_wrap_bits - 1)) > st->cur_dts) { pkt->dts -= 1LL << st->pts_wrap_bits;

1 0

avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Feb 19 21:43:45 2021 +0100| [1cf96ce269364e3c2b4ec2097f121ad42b336839] | committer: Michael Niedermayer avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice() Found-by: Jeremy Leconte <jleconte(a)google.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1cf96ce269364e3c2… --- libavfilter/vf_scale.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c index 58eee96744..5ad9334d02 100644 --- a/libavfilter/vf_scale.c +++ b/libavfilter/vf_scale.c @@ -635,8 +635,8 @@ static int scale_slice(AVFilterLink *link, AVFrame *out_buf, AVFrame *cur_pic, s int vsub= ((i+1)&2) ? scale->vsub : 0; in_stride[i] = cur_pic->linesize[i] * mul; out_stride[i] = out_buf->linesize[i] * mul; - in[i] = cur_pic->data[i] + ((y>>vsub)+field) * cur_pic->linesize[i]; - out[i] = out_buf->data[i] + field * out_buf->linesize[i]; + in[i] = FF_PTR_ADD(cur_pic->data[i], ((y>>vsub)+field) * cur_pic->linesize[i]); + out[i] = FF_PTR_ADD(out_buf->data[i], field * out_buf->linesize[i]); } if (scale->input_is_pal) in[1] = cur_pic->data[1];

1 0

avutil/common: Add FF_PTR_ADD()
by Michael Niedermayer 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Mar 15 09:47:43 2021 +0100| [522a5259e9cc17faf1f83c9cfb93c960a2ecf8a2] | committer: Michael Niedermayer avutil/common: Add FF_PTR_ADD() Suggested-by: Andreas Rheinhardt Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=522a5259e9cc17faf… --- libavutil/internal.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavutil/internal.h b/libavutil/internal.h index 572daefec3..2ed1c2abb1 100644 --- a/libavutil/internal.h +++ b/libavutil/internal.h @@ -102,6 +102,8 @@ #define FF_ALLOC_TYPED_ARRAY(p, nelem) (p = av_malloc_array(nelem, sizeof(*p))) #define FF_ALLOCZ_TYPED_ARRAY(p, nelem) (p = av_mallocz_array(nelem, sizeof(*p))) +#define FF_PTR_ADD(ptr, off) ((off) ? (ptr) + (off) : (ptr)) + #include "libm.h" /**

1 0

avformat/asf: Factor common code out
by Andreas Rheinhardt 31 Mar '21

31 Mar '21

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Mon Mar 29 08:31:36 2021 +0200| [dfeb9b3a8b5a5680ae7d3e813314bb434b2788c4] | committer: Andreas Rheinhardt avformat/asf: Factor common code out Both functions to read attached pictures coincide since e83f27a21a6d2f602b55e541ef66e365400e9827 (save for some log messages in case av_dict_set failed). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dfeb9b3a8b5a5680a… --- libavformat/asf.c | 117 +++++++++++++++++++++++++++++++++++++++++++++++++ libavformat/asf.h | 10 +++++ libavformat/asfdec_f.c | 109 +-------------------------------------------- libavformat/asfdec_o.c | 114 +---------------------------------------------- 4 files changed, 129 insertions(+), 221 deletions(-) diff --git a/libavformat/asf.c b/libavformat/asf.c index f1f171e6f6..204355abab 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -19,6 +19,7 @@ */ #include "asf.h" +#include "id3v2.h" const ff_asf_guid ff_asf_header = { 0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11, 0xA6, 0xD9, 0x00, 0xAA, 0x00, 0x62, 0xCE, 0x6C @@ -170,3 +171,119 @@ const AVMetadataConv ff_asf_metadata_conv[] = { // { "Year" , "date" }, TODO: conversion year<->date { 0 } }; + +/* MSDN claims that this should be "compatible with the ID3 frame, APIC", + * but in reality this is only loosely similar */ +static int asf_read_picture(AVFormatContext *s, int len) +{ + AVPacket pkt = { 0 }; + const CodecMime *mime = ff_id3v2_mime_tags; + enum AVCodecID id = AV_CODEC_ID_NONE; + char mimetype[64]; + uint8_t *desc = NULL; + AVStream *st = NULL; + int ret, type, picsize, desc_len; + + /* type + picsize + mime + desc */ + if (len < 1 + 4 + 2 + 2) { + av_log(s, AV_LOG_ERROR, "Invalid attached picture size: %d.\n", len); + return AVERROR_INVALIDDATA; + } + + /* picture type */ + type = avio_r8(s->pb); + len--; + if (type >= FF_ARRAY_ELEMS(ff_id3v2_picture_types) || type < 0) { + av_log(s, AV_LOG_WARNING, "Unknown attached picture type: %d.\n", type); + type = 0; + } + + /* picture data size */ + picsize = avio_rl32(s->pb); + len -= 4; + + /* picture MIME type */ + len -= avio_get_str16le(s->pb, len, mimetype, sizeof(mimetype)); + while (mime->id != AV_CODEC_ID_NONE) { + if (!strncmp(mime->str, mimetype, sizeof(mimetype))) { + id = mime->id; + break; + } + mime++; + } + if (id == AV_CODEC_ID_NONE) { + av_log(s, AV_LOG_ERROR, "Unknown attached picture mimetype: %s.\n", + mimetype); + return 0; + } + + if (picsize >= len) { + av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d >= %d.\n", + picsize, len); + return AVERROR_INVALIDDATA; + } + + /* picture description */ + desc_len = (len - picsize) * 2 + 1; + desc = av_malloc(desc_len); + if (!desc) + return AVERROR(ENOMEM); + len -= avio_get_str16le(s->pb, len - picsize, desc, desc_len); + + ret = av_get_packet(s->pb, &pkt, picsize); + if (ret < 0) + goto fail; + + st = avformat_new_stream(s, NULL); + if (!st) { + ret = AVERROR(ENOMEM); + goto fail; + } + + st->disposition |= AV_DISPOSITION_ATTACHED_PIC; + st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; + st->codecpar->codec_id = id; + st->attached_pic = pkt; + st->attached_pic.stream_index = st->index; + st->attached_pic.flags |= AV_PKT_FLAG_KEY; + + if (*desc) { + if (av_dict_set(&st->metadata, "title", desc, AV_DICT_DONT_STRDUP_VAL) < 0) + av_log(s, AV_LOG_WARNING, "av_dict_set failed.\n"); + } else + av_freep(&desc); + + if (av_dict_set(&st->metadata, "comment", ff_id3v2_picture_types[type], 0) < 0) + av_log(s, AV_LOG_WARNING, "av_dict_set failed.\n"); + + return 0; + +fail: + av_freep(&desc); + av_packet_unref(&pkt); + return ret; +} + +static int get_id3_tag(AVFormatContext *s, int len) +{ + ID3v2ExtraMeta *id3v2_extra_meta = NULL; + + ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta, len); + if (id3v2_extra_meta) { + ff_id3v2_parse_apic(s, id3v2_extra_meta); + ff_id3v2_parse_chapters(s, id3v2_extra_meta); + ff_id3v2_free_extra_meta(&id3v2_extra_meta); + } + return 0; +} + +int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, + int val_len) +{ + if (!strcmp(name, "WM/Picture")) // handle cover art + return asf_read_picture(s, val_len); + else if (!strcmp(name, "ID3")) // handle ID3 tag + return get_id3_tag(s, val_len); + + return 1; +} diff --git a/libavformat/asf.h b/libavformat/asf.h index bce820efae..01cc4f7a46 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -104,6 +104,16 @@ extern const ff_asf_guid ff_asf_mutex_language; extern const AVMetadataConv ff_asf_metadata_conv[]; +/** + * Handles both attached pictures as well as id3 tags. + * + * @return Returns < 0 on error, 1 if the type of the byte array + * is unsupported by this function and 0 otherwise. + */ +int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, + int val_len); + + #define ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT 0x80 //1000 0000 diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 2fae528f4d..27162e9559 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -33,7 +33,6 @@ #include "avformat.h" #include "avio_internal.h" #include "avlanguage.h" -#include "id3v2.h" #include "internal.h" #include "riff.h" #include "asf.h" @@ -219,107 +218,6 @@ static int get_value(AVIOContext *pb, int type, int type2_size) } } -/* MSDN claims that this should be "compatible with the ID3 frame, APIC", - * but in reality this is only loosely similar */ -static int asf_read_picture(AVFormatContext *s, int len) -{ - AVPacket pkt = { 0 }; - const CodecMime *mime = ff_id3v2_mime_tags; - enum AVCodecID id = AV_CODEC_ID_NONE; - char mimetype[64]; - uint8_t *desc = NULL; - AVStream *st = NULL; - int ret, type, picsize, desc_len; - - /* type + picsize + mime + desc */ - if (len < 1 + 4 + 2 + 2) { - av_log(s, AV_LOG_ERROR, "Invalid attached picture size: %d.\n", len); - return AVERROR_INVALIDDATA; - } - - /* picture type */ - type = avio_r8(s->pb); - len--; - if (type >= FF_ARRAY_ELEMS(ff_id3v2_picture_types) || type < 0) { - av_log(s, AV_LOG_WARNING, "Unknown attached picture type: %d.\n", type); - type = 0; - } - - /* picture data size */ - picsize = avio_rl32(s->pb); - len -= 4; - - /* picture MIME type */ - len -= avio_get_str16le(s->pb, len, mimetype, sizeof(mimetype)); - while (mime->id != AV_CODEC_ID_NONE) { - if (!strncmp(mime->str, mimetype, sizeof(mimetype))) { - id = mime->id; - break; - } - mime++; - } - if (id == AV_CODEC_ID_NONE) { - av_log(s, AV_LOG_ERROR, "Unknown attached picture mimetype: %s.\n", - mimetype); - return 0; - } - - if (picsize >= len) { - av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d >= %d.\n", - picsize, len); - return AVERROR_INVALIDDATA; - } - - /* picture description */ - desc_len = (len - picsize) * 2 + 1; - desc = av_malloc(desc_len); - if (!desc) - return AVERROR(ENOMEM); - len -= avio_get_str16le(s->pb, len - picsize, desc, desc_len); - - ret = av_get_packet(s->pb, &pkt, picsize); - if (ret < 0) - goto fail; - - st = avformat_new_stream(s, NULL); - if (!st) { - ret = AVERROR(ENOMEM); - goto fail; - } - st->disposition |= AV_DISPOSITION_ATTACHED_PIC; - st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; - st->codecpar->codec_id = id; - st->attached_pic = pkt; - st->attached_pic.stream_index = st->index; - st->attached_pic.flags |= AV_PKT_FLAG_KEY; - - if (*desc) - av_dict_set(&st->metadata, "title", desc, AV_DICT_DONT_STRDUP_VAL); - else - av_freep(&desc); - - av_dict_set(&st->metadata, "comment", ff_id3v2_picture_types[type], 0); - - return 0; - -fail: - av_freep(&desc); - av_packet_unref(&pkt); - return ret; -} - -static void get_id3_tag(AVFormatContext *s, int len) -{ - ID3v2ExtraMeta *id3v2_extra_meta = NULL; - - ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta, len); - if (id3v2_extra_meta) { - ff_id3v2_parse_apic(s, id3v2_extra_meta); - ff_id3v2_parse_chapters(s, id3v2_extra_meta); - } - ff_id3v2_free_extra_meta(&id3v2_extra_meta); -} - static void get_tag(AVFormatContext *s, const char *key, int type, int len, int type2_size) { ASFContext *asf = s->priv_data; @@ -345,13 +243,8 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int value[len]=0; break; case ASF_BYTE_ARRAY: - if (!strcmp(key, "WM/Picture")) { // handle cover art - asf_read_picture(s, len); - } else if (!strcmp(key, "ID3")) { // handle ID3 tag - get_id3_tag(s, len); - } else { + if (ff_asf_handle_byte_array(s, key, len) > 0) av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", key); - } goto finish; case ASF_BOOL: case ASF_DWORD: diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c index 34ae541934..6cfcd8b088 100644 --- a/libavformat/asfdec_o.c +++ b/libavformat/asfdec_o.c @@ -20,19 +20,15 @@ */ #include "libavutil/attributes.h" -#include "libavutil/avstring.h" -#include "libavutil/bswap.h" #include "libavutil/common.h" #include "libavutil/dict.h" #include "libavutil/internal.h" #include "libavutil/mathematics.h" -#include "libavutil/opt.h" #include "libavutil/time_internal.h" #include "avformat.h" #include "avio_internal.h" #include "avlanguage.h" -#include "id3v2.h" #include "internal.h" #include "riff.h" #include "asf.h" @@ -356,110 +352,6 @@ static int asf_set_metadata(AVFormatContext *s, const uint8_t *name, return 0; } -/* MSDN claims that this should be "compatible with the ID3 frame, APIC", - * but in reality this is only loosely similar */ -static int asf_read_picture(AVFormatContext *s, int len) -{ - AVPacket pkt = { 0 }; - const CodecMime *mime = ff_id3v2_mime_tags; - enum AVCodecID id = AV_CODEC_ID_NONE; - char mimetype[64]; - uint8_t *desc = NULL; - AVStream *st = NULL; - int ret, type, picsize, desc_len; - - /* type + picsize + mime + desc */ - if (len < 1 + 4 + 2 + 2) { - av_log(s, AV_LOG_ERROR, "Invalid attached picture size: %d.\n", len); - return AVERROR_INVALIDDATA; - } - - /* picture type */ - type = avio_r8(s->pb); - len--; - if (type >= FF_ARRAY_ELEMS(ff_id3v2_picture_types) || type < 0) { - av_log(s, AV_LOG_WARNING, "Unknown attached picture type: %d.\n", type); - type = 0; - } - - /* picture data size */ - picsize = avio_rl32(s->pb); - len -= 4; - - /* picture MIME type */ - len -= avio_get_str16le(s->pb, len, mimetype, sizeof(mimetype)); - while (mime->id != AV_CODEC_ID_NONE) { - if (!strncmp(mime->str, mimetype, sizeof(mimetype))) { - id = mime->id; - break; - } - mime++; - } - if (id == AV_CODEC_ID_NONE) { - av_log(s, AV_LOG_ERROR, "Unknown attached picture mimetype: %s.\n", - mimetype); - return 0; - } - - if (picsize >= len) { - av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d >= %d.\n", - picsize, len); - return AVERROR_INVALIDDATA; - } - - /* picture description */ - desc_len = (len - picsize) * 2 + 1; - desc = av_malloc(desc_len); - if (!desc) - return AVERROR(ENOMEM); - len -= avio_get_str16le(s->pb, len - picsize, desc, desc_len); - - ret = av_get_packet(s->pb, &pkt, picsize); - if (ret < 0) - goto fail; - - st = avformat_new_stream(s, NULL); - if (!st) { - ret = AVERROR(ENOMEM); - goto fail; - } - - st->disposition |= AV_DISPOSITION_ATTACHED_PIC; - st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; - st->codecpar->codec_id = id; - st->attached_pic = pkt; - st->attached_pic.stream_index = st->index; - st->attached_pic.flags |= AV_PKT_FLAG_KEY; - - if (*desc) { - if (av_dict_set(&st->metadata, "title", desc, AV_DICT_DONT_STRDUP_VAL) < 0) - av_log(s, AV_LOG_WARNING, "av_dict_set failed.\n"); - } else - av_freep(&desc); - - if (av_dict_set(&st->metadata, "comment", ff_id3v2_picture_types[type], 0) < 0) - av_log(s, AV_LOG_WARNING, "av_dict_set failed.\n"); - - return 0; - -fail: - av_freep(&desc); - av_packet_unref(&pkt); - return ret; -} - -static void get_id3_tag(AVFormatContext *s, int len) -{ - ID3v2ExtraMeta *id3v2_extra_meta = NULL; - - ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta, len); - if (id3v2_extra_meta) { - ff_id3v2_parse_apic(s, id3v2_extra_meta); - ff_id3v2_parse_chapters(s, id3v2_extra_meta); - } - ff_id3v2_free_extra_meta(&id3v2_extra_meta); -} - static int process_metadata(AVFormatContext *s, const uint8_t *name, uint16_t name_len, uint16_t val_len, uint16_t type, AVDictionary **met) { @@ -472,11 +364,7 @@ static int process_metadata(AVFormatContext *s, const uint8_t *name, uint16_t na asf_read_value(s, name, val_len, type, met); break; case ASF_BYTE_ARRAY: - if (!strcmp(name, "WM/Picture")) // handle cover art - asf_read_picture(s, val_len); - else if (!strcmp(name, "ID3")) // handle ID3 tag - get_id3_tag(s, val_len); - else + if (ff_asf_handle_byte_array(s, name, val_len) > 0) asf_read_value(s, name, val_len, type, met); break; case ASF_GUID:

1 0