various security fixes and precautionary checks
[libav.git] / libavformat / 4xm.c
1 /*
2 * 4X Technologies .4xm File Demuxer (no muxer)
3 * Copyright (c) 2003 The ffmpeg Project
4 *
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2 of the License, or (at your option) any later version.
9 *
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
14 *
15 * You should have received a copy of the GNU Lesser General Public
16 * License along with this library; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18 */
19
20 /**
21 * @file 4xm.c
22 * 4X Technologies file demuxer
23 * by Mike Melanson (melanson@pcisys.net)
24 * for more information on the .4xm file format, visit:
25 * http://www.pcisys.net/~melanson/codecs/
26 */
27
28 #include "avformat.h"
29
30 #define RIFF_TAG MKTAG('R', 'I', 'F', 'F')
31 #define _4XMV_TAG MKTAG('4', 'X', 'M', 'V')
32 #define LIST_TAG MKTAG('L', 'I', 'S', 'T')
33 #define HEAD_TAG MKTAG('H', 'E', 'A', 'D')
34 #define TRK__TAG MKTAG('T', 'R', 'K', '_')
35 #define MOVI_TAG MKTAG('M', 'O', 'V', 'I')
36 #define VTRK_TAG MKTAG('V', 'T', 'R', 'K')
37 #define STRK_TAG MKTAG('S', 'T', 'R', 'K')
38 #define std__TAG MKTAG('s', 't', 'd', '_')
39 #define name_TAG MKTAG('n', 'a', 'm', 'e')
40 #define vtrk_TAG MKTAG('v', 't', 'r', 'k')
41 #define strk_TAG MKTAG('s', 't', 'r', 'k')
42 #define ifrm_TAG MKTAG('i', 'f', 'r', 'm')
43 #define pfrm_TAG MKTAG('p', 'f', 'r', 'm')
44 #define cfrm_TAG MKTAG('c', 'f', 'r', 'm')
45 #define snd__TAG MKTAG('s', 'n', 'd', '_')
46
47 #define vtrk_SIZE 0x44
48 #define strk_SIZE 0x28
49
50 #define GET_LIST_HEADER() \
51 fourcc_tag = get_le32(pb); \
52 size = get_le32(pb); \
53 if (fourcc_tag != LIST_TAG) \
54 return AVERROR_INVALIDDATA; \
55 fourcc_tag = get_le32(pb);
56
57 typedef struct AudioTrack {
58 int sample_rate;
59 int bits;
60 int channels;
61 int stream_index;
62 int adpcm;
63 } AudioTrack;
64
65 typedef struct FourxmDemuxContext {
66 int width;
67 int height;
68 int video_stream_index;
69 int track_count;
70 AudioTrack *tracks;
71 int selected_track;
72
73 int64_t audio_pts;
74 int64_t video_pts;
75 int video_pts_inc;
76 float fps;
77 } FourxmDemuxContext;
78
79 static float get_le_float(unsigned char *buffer)
80 {
81 float f;
82 unsigned char *float_buffer = (unsigned char *)&f;
83
84 #ifdef WORDS_BIGENDIAN
85 float_buffer[0] = buffer[3];
86 float_buffer[1] = buffer[2];
87 float_buffer[2] = buffer[1];
88 float_buffer[3] = buffer[0];
89 #else
90 float_buffer[0] = buffer[0];
91 float_buffer[1] = buffer[1];
92 float_buffer[2] = buffer[2];
93 float_buffer[3] = buffer[3];
94 #endif
95
96 return f;
97 }
98
99 static int fourxm_probe(AVProbeData *p)
100 {
101 if (p->buf_size < 12)
102 return 0;
103
104 if ((LE_32(&p->buf[0]) != RIFF_TAG) ||
105 (LE_32(&p->buf[8]) != _4XMV_TAG))
106 return 0;
107
108 return AVPROBE_SCORE_MAX;
109 }
110
111 static int fourxm_read_header(AVFormatContext *s,
112 AVFormatParameters *ap)
113 {
114 ByteIOContext *pb = &s->pb;
115 unsigned int fourcc_tag;
116 unsigned int size;
117 int header_size;
118 FourxmDemuxContext *fourxm = (FourxmDemuxContext *)s->priv_data;
119 unsigned char *header;
120 int i;
121 int current_track = -1;
122 AVStream *st;
123
124 fourxm->track_count = 0;
125 fourxm->tracks = NULL;
126 fourxm->selected_track = 0;
127 fourxm->fps = 1.0;
128
129 /* skip the first 3 32-bit numbers */
130 url_fseek(pb, 12, SEEK_CUR);
131
132 /* check for LIST-HEAD */
133 GET_LIST_HEADER();
134 header_size = size - 4;
135 if (fourcc_tag != HEAD_TAG)
136 return AVERROR_INVALIDDATA;
137
138 /* allocate space for the header and load the whole thing */
139 header = av_malloc(header_size);
140 if (!header)
141 return AVERROR_NOMEM;
142 if (get_buffer(pb, header, header_size) != header_size)
143 return AVERROR_IO;
144
145 /* take the lazy approach and search for any and all vtrk and strk chunks */
146 for (i = 0; i < header_size - 8; i++) {
147 fourcc_tag = LE_32(&header[i]);
148 size = LE_32(&header[i + 4]);
149
150 if (fourcc_tag == std__TAG) {
151 fourxm->fps = get_le_float(&header[i + 12]);
152 fourxm->video_pts_inc = (int)(90000.0 / fourxm->fps);
153 } else if (fourcc_tag == vtrk_TAG) {
154 /* check that there is enough data */
155 if (size != vtrk_SIZE) {
156 av_free(header);
157 return AVERROR_INVALIDDATA;
158 }
159 fourxm->width = LE_32(&header[i + 36]);
160 fourxm->height = LE_32(&header[i + 40]);
161 i += 8 + size;
162
163 /* allocate a new AVStream */
164 st = av_new_stream(s, 0);
165 if (!st)
166 return AVERROR_NOMEM;
167 av_set_pts_info(st, 33, 1, 90000);
168
169 fourxm->video_stream_index = st->index;
170
171 st->codec.frame_rate = fourxm->fps;
172 st->codec.frame_rate_base = 1.0;
173 st->codec.codec_type = CODEC_TYPE_VIDEO;
174 st->codec.codec_id = CODEC_ID_4XM;
175 st->codec.codec_tag = 0; /* no fourcc */
176 st->codec.width = fourxm->width;
177 st->codec.height = fourxm->height;
178
179 } else if (fourcc_tag == strk_TAG) {
180 /* check that there is enough data */
181 if (size != strk_SIZE) {
182 av_free(header);
183 return AVERROR_INVALIDDATA;
184 }
185 current_track = LE_32(&header[i + 8]);
186 if (current_track + 1 > fourxm->track_count) {
187 fourxm->track_count = current_track + 1;
188 if((unsigned)fourxm->track_count >= UINT_MAX / sizeof(AudioTrack))
189 return -1;
190 fourxm->tracks = av_realloc(fourxm->tracks,
191 fourxm->track_count * sizeof(AudioTrack));
192 if (!fourxm->tracks) {
193 av_free(header);
194 return AVERROR_NOMEM;
195 }
196 }
197 fourxm->tracks[current_track].adpcm = LE_32(&header[i + 12]);
198 fourxm->tracks[current_track].channels = LE_32(&header[i + 36]);
199 fourxm->tracks[current_track].sample_rate = LE_32(&header[i + 40]);
200 fourxm->tracks[current_track].bits = LE_32(&header[i + 44]);
201 i += 8 + size;
202
203 /* allocate a new AVStream */
204 st = av_new_stream(s, current_track);
205 if (!st)
206 return AVERROR_NOMEM;
207
208 /* set the pts reference (1 pts = 1/90000) */
209 av_set_pts_info(st, 33, 1, 90000);
210
211 fourxm->tracks[current_track].stream_index = st->index;
212
213 st->codec.codec_type = CODEC_TYPE_AUDIO;
214 st->codec.codec_tag = 1;
215 st->codec.channels = fourxm->tracks[current_track].channels;
216 st->codec.sample_rate = fourxm->tracks[current_track].sample_rate;
217 st->codec.bits_per_sample = fourxm->tracks[current_track].bits;
218 st->codec.bit_rate = st->codec.channels * st->codec.sample_rate *
219 st->codec.bits_per_sample;
220 st->codec.block_align = st->codec.channels * st->codec.bits_per_sample;
221 if (fourxm->tracks[current_track].adpcm)
222 st->codec.codec_id = CODEC_ID_ADPCM_4XM;
223 else if (st->codec.bits_per_sample == 8)
224 st->codec.codec_id = CODEC_ID_PCM_U8;
225 else
226 st->codec.codec_id = CODEC_ID_PCM_S16LE;
227 }
228 }
229
230 av_free(header);
231
232 /* skip over the LIST-MOVI chunk (which is where the stream should be */
233 GET_LIST_HEADER();
234 if (fourcc_tag != MOVI_TAG)
235 return AVERROR_INVALIDDATA;
236
237 /* initialize context members */
238 fourxm->video_pts = -fourxm->video_pts_inc; /* first frame will push to 0 */
239 fourxm->audio_pts = 0;
240
241 return 0;
242 }
243
244 static int fourxm_read_packet(AVFormatContext *s,
245 AVPacket *pkt)
246 {
247 FourxmDemuxContext *fourxm = s->priv_data;
248 ByteIOContext *pb = &s->pb;
249 unsigned int fourcc_tag;
250 unsigned int size, out_size;
251 int ret = 0;
252 int track_number;
253 int packet_read = 0;
254 unsigned char header[8];
255 int64_t pts_inc;
256 int audio_frame_count;
257
258 while (!packet_read) {
259
260 if ((ret = get_buffer(&s->pb, header, 8)) < 0)
261 return ret;
262 fourcc_tag = LE_32(&header[0]);
263 size = LE_32(&header[4]);
264 if (url_feof(pb))
265 return AVERROR_IO;
266 switch (fourcc_tag) {
267
268 case LIST_TAG:
269 /* this is a good time to bump the video pts */
270 fourxm->video_pts += fourxm->video_pts_inc;
271
272 /* skip the LIST-* tag and move on to the next fourcc */
273 get_le32(pb);
274 break;
275
276 case ifrm_TAG:
277 case pfrm_TAG:
278 case cfrm_TAG:{
279
280 /* allocate 8 more bytes than 'size' to account for fourcc
281 * and size */
282 if (size + 8 < size || av_new_packet(pkt, size + 8))
283 return AVERROR_IO;
284 pkt->stream_index = fourxm->video_stream_index;
285 pkt->pts = fourxm->video_pts;
286 memcpy(pkt->data, header, 8);
287 ret = get_buffer(&s->pb, &pkt->data[8], size);
288
289 if (ret < 0)
290 av_free_packet(pkt);
291 else
292 packet_read = 1;
293 break;
294 }
295
296 case snd__TAG:
297 track_number = get_le32(pb);
298 out_size= get_le32(pb);
299 size-=8;
300
301 if (track_number == fourxm->selected_track) {
302 if (av_new_packet(pkt, size))
303 return AVERROR_IO;
304 pkt->stream_index =
305 fourxm->tracks[fourxm->selected_track].stream_index;
306 pkt->pts = fourxm->audio_pts;
307 ret = get_buffer(&s->pb, pkt->data, size);
308 if (ret < 0)
309 av_free_packet(pkt);
310 else
311 packet_read = 1;
312
313 /* pts accounting */
314 audio_frame_count = size;
315 if (fourxm->tracks[fourxm->selected_track].adpcm)
316 audio_frame_count -=
317 2 * (fourxm->tracks[fourxm->selected_track].channels);
318 audio_frame_count /=
319 fourxm->tracks[fourxm->selected_track].channels;
320 if (fourxm->tracks[fourxm->selected_track].adpcm)
321 audio_frame_count *= 2;
322 else
323 audio_frame_count /=
324 (fourxm->tracks[fourxm->selected_track].bits / 8);
325 pts_inc = audio_frame_count;
326 pts_inc *= 90000;
327 pts_inc /= fourxm->tracks[fourxm->selected_track].sample_rate;
328 fourxm->audio_pts += pts_inc;
329
330 } else {
331 url_fseek(pb, size, SEEK_CUR);
332 }
333 break;
334
335 default:
336 url_fseek(pb, size, SEEK_CUR);
337 break;
338 }
339 }
340 return ret;
341 }
342
343 static int fourxm_read_close(AVFormatContext *s)
344 {
345 FourxmDemuxContext *fourxm = (FourxmDemuxContext *)s->priv_data;
346
347 av_free(fourxm->tracks);
348
349 return 0;
350 }
351
352 static AVInputFormat fourxm_iformat = {
353 "4xm",
354 "4X Technologies format",
355 sizeof(FourxmDemuxContext),
356 fourxm_probe,
357 fourxm_read_header,
358 fourxm_read_packet,
359 fourxm_read_close,
360 };
361
362 int fourxm_init(void)
363 {
364 av_register_input_format(&fourxm_iformat);
365 return 0;
366 }