avcodec/h264_slice: Fix overflow in slice offset
[ffmpeg.git] / libavcodec / dca_parser.c
index 9dafe70..11ddb8f 100644 (file)
@@ -23,6 +23,9 @@
  */
 
 #include "dca.h"
+#include "dca_core.h"
+#include "dca_exss.h"
+#include "dca_lbr.h"
 #include "dca_syncwords.h"
 #include "get_bits.h"
 #include "parser.h"
@@ -32,6 +35,9 @@ typedef struct DCAParseContext {
     uint32_t lastmarker;
     int size;
     int framesize;
+    unsigned int startpos;
+    DCAExssParser exss;
+    unsigned int sr_code;
 } DCAParseContext;
 
 #define IS_CORE_MARKER(state) \
@@ -47,6 +53,14 @@ typedef struct DCAParseContext {
 #define CORE_MARKER(state)      ((state >> 16) & 0xFFFFFFFF)
 #define EXSS_MARKER(state)      (state & 0xFFFFFFFF)
 
+#define STATE_LE(state)     (((state & 0xFF00FF00) >> 8) | ((state & 0x00FF00FF) << 8))
+#define STATE_14(state)     (((state & 0x3FFF0000) >> 8) | ((state & 0x00003FFF) >> 6))
+
+#define CORE_FRAMESIZE(state)   (((state >> 4) & 0x3FFF) + 1)
+#define EXSS_FRAMESIZE(state)   ((state & 0x2000000000) ? \
+                                 ((state >>  5) & 0xFFFFF) + 1 : \
+                                 ((state >> 13) & 0x0FFFF) + 1)
+
 /**
  * Find the end of the current frame in the bitstream.
  * @return the position of the first byte of the next frame, or -1
@@ -54,41 +68,105 @@ typedef struct DCAParseContext {
 static int dca_find_frame_end(DCAParseContext *pc1, const uint8_t *buf,
                               int buf_size)
 {
-    int start_found, i;
+    int start_found, size, i;
     uint64_t state;
     ParseContext *pc = &pc1->pc;
 
     start_found = pc->frame_start_found;
     state       = pc->state64;
+    size        = pc1->size;
 
     i = 0;
     if (!start_found) {
-        for (i = 0; i < buf_size; i++) {
+        for (; i < buf_size; i++) {
+            size++;
             state = (state << 8) | buf[i];
-            if (IS_MARKER(state)) {
-                if (!pc1->lastmarker ||
-                    pc1->lastmarker == CORE_MARKER(state) ||
-                    pc1->lastmarker == DCA_SYNCWORD_SUBSTREAM) {
-                    start_found = 1;
-                    if (IS_EXSS_MARKER(state))
-                        pc1->lastmarker = EXSS_MARKER(state);
-                    else
-                        pc1->lastmarker = CORE_MARKER(state);
-                    i++;
-                    break;
-                }
+
+            if (IS_MARKER(state) &&
+                (!pc1->lastmarker ||
+                  pc1->lastmarker == CORE_MARKER(state) ||
+                  pc1->lastmarker == DCA_SYNCWORD_SUBSTREAM)) {
+                if (!pc1->lastmarker)
+                    pc1->startpos = IS_EXSS_MARKER(state) ? size - 4 : size - 6;
+
+                if (IS_EXSS_MARKER(state))
+                    pc1->lastmarker = EXSS_MARKER(state);
+                else
+                    pc1->lastmarker = CORE_MARKER(state);
+
+                start_found = 1;
+                size        = 0;
+
+                i++;
+                break;
             }
         }
     }
+
     if (start_found) {
         for (; i < buf_size; i++) {
-            pc1->size++;
+            size++;
             state = (state << 8) | buf[i];
+
+            if (start_found == 1) {
+                switch (pc1->lastmarker) {
+                case DCA_SYNCWORD_CORE_BE:
+                    if (size == 2) {
+                        pc1->framesize = CORE_FRAMESIZE(state);
+                        start_found    = 2;
+                    }
+                    break;
+                case DCA_SYNCWORD_CORE_LE:
+                    if (size == 2) {
+                        pc1->framesize = CORE_FRAMESIZE(STATE_LE(state));
+                        start_found    = 4;
+                    }
+                    break;
+                case DCA_SYNCWORD_CORE_14B_BE:
+                    if (size == 4) {
+                        pc1->framesize = CORE_FRAMESIZE(STATE_14(state)) * 8 / 14 * 2;
+                        start_found    = 4;
+                    }
+                    break;
+                case DCA_SYNCWORD_CORE_14B_LE:
+                    if (size == 4) {
+                        pc1->framesize = CORE_FRAMESIZE(STATE_14(STATE_LE(state))) * 8 / 14 * 2;
+                        start_found    = 4;
+                    }
+                    break;
+                case DCA_SYNCWORD_SUBSTREAM:
+                    if (size == 6) {
+                        pc1->framesize = EXSS_FRAMESIZE(state);
+                        start_found    = 4;
+                    }
+                    break;
+                default:
+                    av_assert0(0);
+                }
+                continue;
+            }
+
+            if (start_found == 2 && IS_EXSS_MARKER(state) &&
+                pc1->framesize <= size + 2) {
+                pc1->framesize  = size + 2;
+                start_found     = 3;
+                continue;
+            }
+
+            if (start_found == 3) {
+                if (size == pc1->framesize + 4) {
+                    pc1->framesize += EXSS_FRAMESIZE(state);
+                    start_found     = 4;
+                }
+                continue;
+            }
+
+            if (pc1->framesize > size)
+                continue;
+
             if (IS_MARKER(state) &&
                 (pc1->lastmarker == CORE_MARKER(state) ||
                  pc1->lastmarker == DCA_SYNCWORD_SUBSTREAM)) {
-                if (pc1->framesize > pc1->size)
-                    continue;
                 pc->frame_start_found = 0;
                 pc->state64           = -1;
                 pc1->size             = 0;
@@ -96,8 +174,10 @@ static int dca_find_frame_end(DCAParseContext *pc1, const uint8_t *buf,
             }
         }
     }
+
     pc->frame_start_found = start_found;
     pc->state64           = state;
+    pc1->size             = size;
     return END_NOT_FOUND;
 }
 
@@ -106,40 +186,120 @@ static av_cold int dca_parse_init(AVCodecParserContext *s)
     DCAParseContext *pc1 = s->priv_data;
 
     pc1->lastmarker = 0;
+    pc1->sr_code = -1;
     return 0;
 }
 
-static int dca_parse_params(const uint8_t *buf, int buf_size, int *duration,
-                            int *sample_rate, int *framesize)
+static int dca_parse_params(DCAParseContext *pc1, const uint8_t *buf,
+                            int buf_size, int *duration, int *sample_rate,
+                            int *profile)
 {
+    DCAExssAsset *asset = &pc1->exss.assets[0];
     GetBitContext gb;
-    uint8_t hdr[12 + FF_INPUT_BUFFER_PADDING_SIZE] = { 0 };
-    int ret, sample_blocks, sr_code;
+    DCACoreFrameHeader h;
+    uint8_t hdr[DCA_CORE_FRAME_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE] = { 0 };
+    int ret, frame_size;
 
-    if (buf_size < 12)
+    if (buf_size < DCA_CORE_FRAME_HEADER_SIZE)
         return AVERROR_INVALIDDATA;
 
-    if ((ret = avpriv_dca_convert_bitstream(buf, 12, hdr, 12)) < 0)
-        return ret;
+    if (AV_RB32(buf) == DCA_SYNCWORD_SUBSTREAM) {
+        if ((ret = ff_dca_exss_parse(&pc1->exss, buf, buf_size)) < 0)
+            return ret;
 
-    init_get_bits(&gb, hdr, 96);
+        if (asset->extension_mask & DCA_EXSS_LBR) {
+            if ((ret = init_get_bits8(&gb, buf + asset->lbr_offset, asset->lbr_size)) < 0)
+                return ret;
 
-    skip_bits_long(&gb, 39);
-    sample_blocks = get_bits(&gb, 7) + 1;
-    if (sample_blocks < 8)
-        return AVERROR_INVALIDDATA;
-    *duration = 256 * (sample_blocks / 8);
+            if (get_bits_long(&gb, 32) != DCA_SYNCWORD_LBR)
+                return AVERROR_INVALIDDATA;
+
+            switch (get_bits(&gb, 8)) {
+            case DCA_LBR_HEADER_DECODER_INIT:
+                pc1->sr_code = get_bits(&gb, 8);
+            case DCA_LBR_HEADER_SYNC_ONLY:
+                break;
+            default:
+                return AVERROR_INVALIDDATA;
+            }
+
+            if (pc1->sr_code >= FF_ARRAY_ELEMS(ff_dca_sampling_freqs))
+                return AVERROR_INVALIDDATA;
+
+            *sample_rate = ff_dca_sampling_freqs[pc1->sr_code];
+            *duration = 1024 << ff_dca_freq_ranges[pc1->sr_code];
+            *profile = FF_PROFILE_DTS_EXPRESS;
+            return 0;
+        }
+
+        if (asset->extension_mask & DCA_EXSS_XLL) {
+            int nsamples_log2;
+
+            if ((ret = init_get_bits8(&gb, buf + asset->xll_offset, asset->xll_size)) < 0)
+                return ret;
+
+            if (get_bits_long(&gb, 32) != DCA_SYNCWORD_XLL)
+                return AVERROR_INVALIDDATA;
+
+            if (get_bits(&gb, 4))
+                return AVERROR_INVALIDDATA;
+
+            skip_bits(&gb, 8);
+            skip_bits_long(&gb, get_bits(&gb, 5) + 1);
+            skip_bits(&gb, 4);
+            nsamples_log2 = get_bits(&gb, 4) + get_bits(&gb, 4);
+            if (nsamples_log2 > 24)
+                return AVERROR_INVALIDDATA;
+
+            *sample_rate = asset->max_sample_rate;
+            *duration = (1 + (*sample_rate > 96000)) << nsamples_log2;
+            *profile = FF_PROFILE_DTS_HD_MA;
+            return 0;
+        }
 
-    *framesize = get_bits(&gb, 14) + 1;
-    if (*framesize < 95)
         return AVERROR_INVALIDDATA;
+    }
 
-    skip_bits(&gb, 6);
-    sr_code      = get_bits(&gb, 4);
-    *sample_rate = avpriv_dca_sample_rates[sr_code];
-    if (*sample_rate == 0)
+    if ((ret = avpriv_dca_convert_bitstream(buf, DCA_CORE_FRAME_HEADER_SIZE,
+                                            hdr, DCA_CORE_FRAME_HEADER_SIZE)) < 0)
+        return ret;
+    if (avpriv_dca_parse_core_frame_header(&h, hdr, ret) < 0)
         return AVERROR_INVALIDDATA;
 
+    *duration = h.npcmblocks * DCA_PCMBLOCK_SAMPLES;
+    *sample_rate = avpriv_dca_sample_rates[h.sr_code];
+    if (*profile != FF_PROFILE_UNKNOWN)
+        return 0;
+
+    *profile = FF_PROFILE_DTS;
+    if (h.ext_audio_present) {
+        switch (h.ext_audio_type) {
+        case DCA_EXT_AUDIO_XCH:
+        case DCA_EXT_AUDIO_XXCH:
+            *profile = FF_PROFILE_DTS_ES;
+            break;
+        case DCA_EXT_AUDIO_X96:
+            *profile = FF_PROFILE_DTS_96_24;
+            break;
+        }
+    }
+
+    frame_size = FFALIGN(h.frame_size, 4);
+    if (buf_size - 4 < frame_size)
+        return 0;
+
+    buf      += frame_size;
+    buf_size -= frame_size;
+    if (AV_RB32(buf) != DCA_SYNCWORD_SUBSTREAM)
+        return 0;
+    if (ff_dca_exss_parse(&pc1->exss, buf, buf_size) < 0)
+        return 0;
+
+    if (asset->extension_mask & DCA_EXSS_XLL)
+        *profile = FF_PROFILE_DTS_HD_MA;
+    else if (asset->extension_mask & (DCA_EXSS_XBR | DCA_EXSS_XXCH | DCA_EXSS_X96))
+        *profile = FF_PROFILE_DTS_HD_HRA;
+
     return 0;
 }
 
@@ -161,12 +321,20 @@ static int dca_parse(AVCodecParserContext *s, AVCodecContext *avctx,
             *poutbuf_size = 0;
             return buf_size;
         }
+
+        /* skip initial padding */
+        if (buf_size  > pc1->startpos) {
+            buf      += pc1->startpos;
+            buf_size -= pc1->startpos;
+        }
+        pc1->startpos = 0;
     }
 
     /* read the duration and sample rate from the frame header */
-    if (!dca_parse_params(buf, buf_size, &duration, &sample_rate, &pc1->framesize)) {
-        s->duration        = duration;
-        avctx->sample_rate = sample_rate;
+    if (!dca_parse_params(pc1, buf, buf_size, &duration, &sample_rate, &avctx->profile)) {
+        if (!avctx->sample_rate)
+            avctx->sample_rate = sample_rate;
+        s->duration = av_rescale(duration, avctx->sample_rate, sample_rate);
     } else
         s->duration = 0;