virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avformat/mov: (v4) fix get_eia608_packet

Browse Source 
The problem is reproducible with "Test for Quicktime 608 CC file.mov"
from https://samples.ffmpeg.org/MPEG2/subcc/

ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov

See https://trac.ffmpeg.org/ticket/11470
This commit is contained in:
Pavel Koshevoy
2025-02-23 09:43:56 -07:00
parent d5dbcc00d8
commit 5021764413
1 changed files with 59 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
libavformat/mov.c
View File

@ -10788,25 +10788,73 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt)
return 0;
}
static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int src_size)
{
int new_size, ret;
/* We can't make assumptions about the structure of the payload,
because it may include multiple cdat and cdt2 samples. */
const uint32_t cdat = AV_RB32("cdat");
const uint32_t cdt2 = AV_RB32("cdt2");
int ret, out_size = 0;
if (size <= 8)
/* a valid payload must have size, 4cc, and at least 1 byte pair: */
if (src_size < 10)
return AVERROR_INVALIDDATA;
new_size = ((size - 8) / 2) * 3;
ret = av_new_packet(pkt, new_size);
/* avoid an int overflow: */
if ((src_size - 8) / 2 >= INT_MAX / 3)
return AVERROR_INVALIDDATA;
ret = av_new_packet(pkt, ((src_size - 8) / 2) * 3);
if (ret < 0)
return ret;
avio_skip(pb, 8);
for (int j = 0; j < new_size; j += 3) {
pkt->data[j] = 0xFC;
pkt->data[j+1] = avio_r8(pb);
pkt->data[j+2] = avio_r8(pb);
/* parse and re-format the c608 payload in one pass. */
while (src_size >= 10) {
const uint32_t atom_size = avio_rb32(pb);
const uint32_t atom_type = avio_rb32(pb);
const uint32_t data_size = atom_size - 8;
const uint8_t cc_field =
atom_type == cdat ? 1 :
atom_type == cdt2 ? 2 :
0;
/* account for bytes consumed for atom size and type. */
src_size -= 8;
/* make sure the data size stays within the buffer boundaries. */
if (data_size < 2 || data_size > src_size) {
ret = AVERROR_INVALIDDATA;
break;
}
return 0;
/* make sure the data size is consistent with N byte pairs. */
if (data_size % 2 != 0) {
ret = AVERROR_INVALIDDATA;
break;
}
if (!cc_field) {
/* neither cdat or cdt2 ... skip it */
avio_skip(pb, data_size);
src_size -= data_size;
continue;
}
for (uint32_t i = 0; i < data_size; i += 2) {
pkt->data[out_size] = (0x1F << 3) | (1 << 2) | (cc_field - 1);
pkt->data[out_size + 1] = avio_r8(pb);
pkt->data[out_size + 2] = avio_r8(pb);
out_size += 3;
src_size -= 2;
}
}
if (src_size > 0)
/* skip any remaining unread portion of the input payload */
avio_skip(pb, src_size);
av_shrink_packet(pkt, out_size);
return ret;
}
static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *sample,