avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
[FFMpeg-mirror.git] / libavformat / av1dec.c
blob8c0b8fe9754e720c14cd85b2c6504de8db7165fa
1 /*
2 * AV1 Annex B demuxer
3 * Copyright (c) 2019 James Almer <jamrial@gmail.com>
5 * This file is part of FFmpeg.
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 #include "config_components.h"
24 #include "libavutil/common.h"
25 #include "libavutil/opt.h"
26 #include "libavcodec/av1_parse.h"
27 #include "libavcodec/bsf.h"
28 #include "avformat.h"
29 #include "avio_internal.h"
30 #include "demux.h"
31 #include "internal.h"
33 typedef struct AV1DemuxContext {
34 const AVClass *class;
35 AVBSFContext *bsf;
36 AVRational framerate;
37 uint32_t temporal_unit_size;
38 uint32_t frame_unit_size;
39 } AV1DemuxContext;
41 //return < 0 if we need more data
42 static int get_score(int type, int *seq)
44 switch (type) {
45 case AV1_OBU_SEQUENCE_HEADER:
46 *seq = 1;
47 return -1;
48 case AV1_OBU_FRAME:
49 case AV1_OBU_FRAME_HEADER:
50 return *seq ? AVPROBE_SCORE_EXTENSION + 1 : 0;
51 case AV1_OBU_METADATA:
52 case AV1_OBU_PADDING:
53 return -1;
54 default:
55 break;
57 return 0;
60 static int av1_read_header(AVFormatContext *s)
62 AV1DemuxContext *const c = s->priv_data;
63 const AVBitStreamFilter *filter = av_bsf_get_by_name("av1_frame_merge");
64 AVStream *st;
65 FFStream *sti;
66 int ret;
68 if (!filter) {
69 av_log(s, AV_LOG_ERROR, "av1_frame_merge bitstream filter "
70 "not found. This is a bug, please report it.\n");
71 return AVERROR_BUG;
74 st = avformat_new_stream(s, NULL);
75 if (!st)
76 return AVERROR(ENOMEM);
77 sti = ffstream(st);
79 st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
80 st->codecpar->codec_id = AV_CODEC_ID_AV1;
81 sti->need_parsing = AVSTREAM_PARSE_HEADERS;
83 st->avg_frame_rate = c->framerate;
84 // taken from rawvideo demuxers
85 avpriv_set_pts_info(st, 64, 1, 1200000);
87 ret = av_bsf_alloc(filter, &c->bsf);
88 if (ret < 0)
89 return ret;
91 ret = avcodec_parameters_copy(c->bsf->par_in, st->codecpar);
92 if (ret < 0)
93 return ret;
95 ret = av_bsf_init(c->bsf);
96 if (ret < 0)
97 return ret;
99 return 0;
102 static int av1_read_close(AVFormatContext *s)
104 AV1DemuxContext *const c = s->priv_data;
106 av_bsf_free(&c->bsf);
107 return 0;
110 #define DEC AV_OPT_FLAG_DECODING_PARAM
111 #define OFFSET(x) offsetof(AV1DemuxContext, x)
112 static const AVOption av1_options[] = {
113 { "framerate", "", OFFSET(framerate), AV_OPT_TYPE_VIDEO_RATE, {.str = "25"}, 0, INT_MAX, DEC},
114 { NULL },
116 #undef OFFSET
118 static const AVClass av1_demuxer_class = {
119 .class_name = "AV1 Annex B/low overhead OBU demuxer",
120 .item_name = av_default_item_name,
121 .option = av1_options,
122 .version = LIBAVUTIL_VERSION_INT,
125 #if CONFIG_AV1_DEMUXER
127 static int leb(AVIOContext *pb, uint32_t *len, int eof) {
128 int more, i = 0;
129 *len = 0;
130 do {
131 unsigned bits;
132 int byte = avio_r8(pb);
133 if (pb->error)
134 return pb->error;
135 if (pb->eof_reached)
136 return (eof && !i) ? AVERROR_EOF : AVERROR_INVALIDDATA;
137 more = byte & 0x80;
138 bits = byte & 0x7f;
139 if (i <= 3 || (i == 4 && bits < (1 << 4)))
140 *len |= bits << (i * 7);
141 else if (bits)
142 return AVERROR_INVALIDDATA;
143 if (++i == 8 && more)
144 return AVERROR_INVALIDDATA;
145 } while (more);
146 return i;
149 static int read_obu(const uint8_t *buf, int size, int64_t *obu_size, int *type)
151 int start_pos, temporal_id, spatial_id;
152 int len;
154 len = parse_obu_header(buf, size, obu_size, &start_pos,
155 type, &temporal_id, &spatial_id);
156 if (len < 0)
157 return len;
159 return 0;
162 static int annexb_probe(const AVProbeData *p)
164 FFIOContext ctx;
165 AVIOContext *const pb = &ctx.pub;
166 int64_t obu_size;
167 uint32_t temporal_unit_size, frame_unit_size, obu_unit_size;
168 int seq = 0;
169 int ret, type, cnt = 0;
171 ffio_init_read_context(&ctx, p->buf, p->buf_size);
173 ret = leb(pb, &temporal_unit_size, 1);
174 if (ret < 0)
175 return 0;
176 cnt += ret;
177 ret = leb(pb, &frame_unit_size, 0);
178 if (ret < 0 || ((int64_t)frame_unit_size + ret) > temporal_unit_size)
179 return 0;
180 cnt += ret;
181 ret = leb(pb, &obu_unit_size, 0);
182 if (ret < 0 || ((int64_t)obu_unit_size + ret) >= frame_unit_size)
183 return 0;
184 cnt += ret;
186 frame_unit_size -= obu_unit_size + ret;
188 avio_skip(pb, obu_unit_size);
189 if (pb->eof_reached || pb->error)
190 return 0;
192 // Check that the first OBU is a Temporal Delimiter.
193 ret = read_obu(p->buf + cnt, FFMIN(p->buf_size - cnt, obu_unit_size), &obu_size, &type);
194 if (ret < 0 || type != AV1_OBU_TEMPORAL_DELIMITER || obu_size > 0)
195 return 0;
196 cnt += obu_unit_size;
198 do {
199 ret = leb(pb, &obu_unit_size, 0);
200 if (ret < 0 || ((int64_t)obu_unit_size + ret) > frame_unit_size)
201 return 0;
202 cnt += ret;
204 avio_skip(pb, obu_unit_size);
205 if (pb->eof_reached || pb->error)
206 return 0;
208 ret = read_obu(p->buf + cnt, FFMIN(p->buf_size - cnt, obu_unit_size), &obu_size, &type);
209 if (ret < 0)
210 return 0;
211 cnt += obu_unit_size;
213 ret = get_score(type, &seq);
214 if (ret >= 0)
215 return ret;
217 frame_unit_size -= obu_unit_size + ret;
218 } while (frame_unit_size);
220 return 0;
223 static int annexb_read_packet(AVFormatContext *s, AVPacket *pkt)
225 AV1DemuxContext *const c = s->priv_data;
226 uint32_t obu_unit_size;
227 int ret, len;
229 retry:
230 if (avio_feof(s->pb)) {
231 if (c->temporal_unit_size || c->frame_unit_size)
232 return AVERROR_INVALIDDATA;
233 goto end;
236 if (!c->temporal_unit_size) {
237 len = leb(s->pb, &c->temporal_unit_size, 1);
238 if (len == AVERROR_EOF) goto end;
239 else if (len < 0) return len;
242 if (!c->frame_unit_size) {
243 len = leb(s->pb, &c->frame_unit_size, 0);
244 if (len < 0)
245 return len;
246 if (((int64_t)c->frame_unit_size + len) > c->temporal_unit_size)
247 return AVERROR_INVALIDDATA;
248 c->temporal_unit_size -= len;
251 len = leb(s->pb, &obu_unit_size, 0);
252 if (len < 0)
253 return len;
254 if (((int64_t)obu_unit_size + len) > c->frame_unit_size)
255 return AVERROR_INVALIDDATA;
257 ret = av_get_packet(s->pb, pkt, obu_unit_size);
258 if (ret < 0)
259 return ret;
260 if (ret != obu_unit_size)
261 return AVERROR_INVALIDDATA;
263 c->temporal_unit_size -= obu_unit_size + len;
264 c->frame_unit_size -= obu_unit_size + len;
266 end:
267 ret = av_bsf_send_packet(c->bsf, pkt);
268 if (ret < 0) {
269 av_log(s, AV_LOG_ERROR, "Failed to send packet to "
270 "av1_frame_merge filter\n");
271 return ret;
274 ret = av_bsf_receive_packet(c->bsf, pkt);
275 if (ret < 0 && ret != AVERROR(EAGAIN) && ret != AVERROR_EOF)
276 av_log(s, AV_LOG_ERROR, "av1_frame_merge filter failed to "
277 "send output packet\n");
279 if (ret == AVERROR(EAGAIN))
280 goto retry;
282 return ret;
285 const FFInputFormat ff_av1_demuxer = {
286 .p.name = "av1",
287 .p.long_name = NULL_IF_CONFIG_SMALL("AV1 Annex B"),
288 .p.extensions = "obu",
289 .p.flags = AVFMT_GENERIC_INDEX | AVFMT_NOTIMESTAMPS,
290 .p.priv_class = &av1_demuxer_class,
291 .priv_data_size = sizeof(AV1DemuxContext),
292 .flags_internal = FF_INFMT_FLAG_INIT_CLEANUP,
293 .read_probe = annexb_probe,
294 .read_header = av1_read_header,
295 .read_packet = annexb_read_packet,
296 .read_close = av1_read_close,
298 #endif
300 #if CONFIG_OBU_DEMUXER
301 //For low overhead obu, we can't foresee the obu size before we parsed the header.
302 //So, we can't use parse_obu_header here, since it will check size <= buf_size
303 //see c27c7b49dc for more details
304 static int read_obu_with_size(const uint8_t *buf, int buf_size, int64_t *obu_size, int *type)
306 GetBitContext gb;
307 int ret, extension_flag, start_pos;
308 int64_t size;
310 ret = init_get_bits8(&gb, buf, FFMIN(buf_size, MAX_OBU_HEADER_SIZE));
311 if (ret < 0)
312 return ret;
314 if (get_bits1(&gb) != 0) // obu_forbidden_bit
315 return AVERROR_INVALIDDATA;
317 *type = get_bits(&gb, 4);
318 extension_flag = get_bits1(&gb);
319 if (!get_bits1(&gb)) // has_size_flag
320 return AVERROR_INVALIDDATA;
321 skip_bits1(&gb); // obu_reserved_1bit
323 if (extension_flag) {
324 get_bits(&gb, 3); // temporal_id
325 get_bits(&gb, 2); // spatial_id
326 skip_bits(&gb, 3); // extension_header_reserved_3bits
329 *obu_size = get_leb128(&gb);
330 if (*obu_size > INT_MAX)
331 return AVERROR_INVALIDDATA;
333 if (get_bits_left(&gb) < 0)
334 return AVERROR_INVALIDDATA;
336 start_pos = get_bits_count(&gb) / 8;
338 size = *obu_size + start_pos;
339 if (size > INT_MAX)
340 return AVERROR_INVALIDDATA;
341 return size;
344 static int obu_probe(const AVProbeData *p)
346 int64_t obu_size;
347 int seq = 0;
348 int ret, type, cnt;
350 // Check that the first OBU is a Temporal Delimiter.
351 cnt = read_obu_with_size(p->buf, p->buf_size, &obu_size, &type);
352 if (cnt < 0 || type != AV1_OBU_TEMPORAL_DELIMITER || obu_size != 0)
353 return 0;
355 while (1) {
356 ret = read_obu_with_size(p->buf + cnt, p->buf_size - cnt, &obu_size, &type);
357 if (ret < 0 || obu_size <= 0)
358 return 0;
359 cnt += FFMIN(ret, p->buf_size - cnt);
361 ret = get_score(type, &seq);
362 if (ret >= 0)
363 return ret;
365 return 0;
368 static int obu_get_packet(AVFormatContext *s, AVPacket *pkt)
370 AV1DemuxContext *const c = s->priv_data;
371 uint8_t header[MAX_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
372 int64_t obu_size;
373 int size;
374 int ret, len, type;
376 if ((ret = ffio_ensure_seekback(s->pb, MAX_OBU_HEADER_SIZE)) < 0)
377 return ret;
378 size = avio_read(s->pb, header, MAX_OBU_HEADER_SIZE);
379 if (size < 0)
380 return size;
382 memset(header + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
383 len = read_obu_with_size(header, size, &obu_size, &type);
384 if (len < 0) {
385 av_log(c, AV_LOG_ERROR, "Failed to read obu\n");
386 return len;
388 avio_seek(s->pb, -size, SEEK_CUR);
390 ret = av_get_packet(s->pb, pkt, len);
391 if (ret != len) {
392 av_log(c, AV_LOG_ERROR, "Failed to get packet for obu\n");
393 return ret < 0 ? ret : AVERROR_INVALIDDATA;
395 return 0;
398 static int obu_read_packet(AVFormatContext *s, AVPacket *pkt)
400 AV1DemuxContext *const c = s->priv_data;
401 int ret;
403 if (s->io_repositioned) {
404 av_bsf_flush(c->bsf);
405 s->io_repositioned = 0;
407 while (1) {
408 ret = obu_get_packet(s, pkt);
409 /* In case of AVERROR_EOF we need to flush the BSF. Conveniently
410 * obu_get_packet() returns a blank pkt in this case which
411 * can be used to signal that the BSF should be flushed. */
412 if (ret < 0 && ret != AVERROR_EOF)
413 return ret;
414 ret = av_bsf_send_packet(c->bsf, pkt);
415 if (ret < 0) {
416 av_log(s, AV_LOG_ERROR, "Failed to send packet to "
417 "av1_frame_merge filter\n");
418 return ret;
420 ret = av_bsf_receive_packet(c->bsf, pkt);
421 if (ret < 0 && ret != AVERROR(EAGAIN) && ret != AVERROR_EOF)
422 av_log(s, AV_LOG_ERROR, "av1_frame_merge filter failed to "
423 "send output packet\n");
424 if (ret != AVERROR(EAGAIN))
425 break;
428 return ret;
431 const FFInputFormat ff_obu_demuxer = {
432 .p.name = "obu",
433 .p.long_name = NULL_IF_CONFIG_SMALL("AV1 low overhead OBU"),
434 .p.extensions = "obu",
435 .p.flags = AVFMT_GENERIC_INDEX | AVFMT_NO_BYTE_SEEK | AVFMT_NOTIMESTAMPS,
436 .p.priv_class = &av1_demuxer_class,
437 .priv_data_size = sizeof(AV1DemuxContext),
438 .flags_internal = FF_INFMT_FLAG_INIT_CLEANUP,
439 .read_probe = obu_probe,
440 .read_header = av1_read_header,
441 .read_packet = obu_read_packet,
442 .read_close = av1_read_close,
444 #endif