]> git.sesse.net Git - ffmpeg/blob - libavcodec/h264_parser.c
avcodec/jpeg2000dec: check len before parsing header
[ffmpeg] / libavcodec / h264_parser.c
1 /*
2  * H.26L/H.264/AVC/JVT/14496-10/... parser
3  * Copyright (c) 2003 Michael Niedermayer <michaelni@gmx.at>
4  *
5  * This file is part of FFmpeg.
6  *
7  * FFmpeg is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * FFmpeg is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with FFmpeg; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20  */
21
22 /**
23  * @file
24  * H.264 / AVC / MPEG4 part10 parser.
25  * @author Michael Niedermayer <michaelni@gmx.at>
26  */
27
28 #define UNCHECKED_BITSTREAM_READER 1
29
30 #include "libavutil/attributes.h"
31 #include "parser.h"
32 #include "h264data.h"
33 #include "golomb.h"
34 #include "internal.h"
35
36
37 static int h264_find_frame_end(H264Context *h, const uint8_t *buf,
38                                int buf_size)
39 {
40     int i, j;
41     uint32_t state;
42     ParseContext *pc = &h->parse_context;
43     int next_avc= h->is_avc ? 0 : buf_size;
44
45 //    mb_addr= pc->mb_addr - 1;
46     state = pc->state;
47     if (state > 13)
48         state = 7;
49
50     if (h->is_avc && !h->nal_length_size)
51         av_log(h->avctx, AV_LOG_ERROR, "AVC-parser: nal length size invalid\n");
52
53     for (i = 0; i < buf_size; i++) {
54         if (i >= next_avc) {
55             int nalsize = 0;
56             i = next_avc;
57             for (j = 0; j < h->nal_length_size; j++)
58                 nalsize = (nalsize << 8) | buf[i++];
59             if (nalsize <= 0 || nalsize > buf_size - i) {
60                 av_log(h->avctx, AV_LOG_ERROR, "AVC-parser: nal size %d remaining %d\n", nalsize, buf_size - i);
61                 return buf_size;
62             }
63             next_avc = i + nalsize;
64             state    = 5;
65         }
66
67         if (state == 7) {
68 #if HAVE_FAST_UNALIGNED
69             /* we check i < buf_size instead of i + 3 / 7 because it is
70              * simpler and there must be FF_INPUT_BUFFER_PADDING_SIZE
71              * bytes at the end.
72              */
73 #    if HAVE_FAST_64BIT
74             while (i < next_avc &&
75                    !((~*(const uint64_t *)(buf + i) &
76                       (*(const uint64_t *)(buf + i) - 0x0101010101010101ULL)) &
77                       0x8080808080808080ULL))
78                 i += 8;
79 #    else
80             while (i < next_avc &&
81                    !((~*(const uint32_t *)(buf + i) &
82                       (*(const uint32_t *)(buf + i) - 0x01010101U)) &
83                       0x80808080U))
84                 i += 4;
85 #    endif
86 #endif
87             for (; i < next_avc; i++)
88                 if (!buf[i]) {
89                     state = 2;
90                     break;
91                 }
92         } else if (state <= 2) {
93             if (buf[i] == 1)
94                 state ^= 5;            // 2->7, 1->4, 0->5
95             else if (buf[i])
96                 state = 7;
97             else
98                 state >>= 1;           // 2->1, 1->0, 0->0
99         } else if (state <= 5) {
100             int v = buf[i] & 0x1F;
101             if (v == 6 || v == 7 || v == 8 || v == 9) {
102                 if (pc->frame_start_found) {
103                     i++;
104                     goto found;
105                 }
106             } else if (v == 1 || v == 2 || v == 5) {
107                 state += 8;
108                 continue;
109             }
110             state = 7;
111         } else {
112             h->parse_history[h->parse_history_count++]= buf[i];
113             if (h->parse_history_count>3) {
114                 unsigned int mb, last_mb= h->parse_last_mb;
115                 GetBitContext gb;
116
117                 init_get_bits(&gb, h->parse_history, 8*h->parse_history_count);
118                 h->parse_history_count=0;
119                 mb= get_ue_golomb_long(&gb);
120                 last_mb= h->parse_last_mb;
121                 h->parse_last_mb= mb;
122                 if (pc->frame_start_found) {
123                     if (mb <= last_mb)
124                         goto found;
125                 } else
126                     pc->frame_start_found = 1;
127                 state = 7;
128             }
129         }
130     }
131     pc->state = state;
132     if (h->is_avc)
133         return next_avc;
134     return END_NOT_FOUND;
135
136 found:
137     pc->state             = 7;
138     pc->frame_start_found = 0;
139     if (h->is_avc)
140         return next_avc;
141     return i - (state & 5) - 3 * (state > 7);
142 }
143
144 /**
145  * Parse NAL units of found picture and decode some basic information.
146  *
147  * @param s parser context.
148  * @param avctx codec context.
149  * @param buf buffer with field/frame data.
150  * @param buf_size size of the buffer.
151  */
152 static inline int parse_nal_units(AVCodecParserContext *s,
153                                   AVCodecContext *avctx,
154                                   const uint8_t *buf, int buf_size)
155 {
156     H264Context *h         = s->priv_data;
157     const uint8_t *buf_end = buf + buf_size;
158     unsigned int pps_id;
159     unsigned int slice_type;
160     int state = -1;
161     const uint8_t *ptr;
162     int q264 = buf_size >=4 && !memcmp("Q264", buf, 4);
163     int field_poc[2];
164
165     /* set some sane default values */
166     s->pict_type         = AV_PICTURE_TYPE_I;
167     s->key_frame         = 0;
168     s->picture_structure = AV_PICTURE_STRUCTURE_UNKNOWN;
169
170     h->avctx                        = avctx;
171     h->sei_recovery_frame_cnt       = -1;
172     h->sei_dpb_output_delay         = 0;
173     h->sei_cpb_removal_delay        = -1;
174     h->sei_buffering_period_present = 0;
175
176     if (!buf_size)
177         return 0;
178
179     for (;;) {
180         int src_length, dst_length, consumed, nalsize = 0;
181         if (h->is_avc) {
182             int i;
183             if (h->nal_length_size >= buf_end - buf) break;
184             nalsize = 0;
185             for (i = 0; i < h->nal_length_size; i++)
186                 nalsize = (nalsize << 8) | *buf++;
187             if (nalsize <= 0 || nalsize > buf_end - buf) {
188                 av_log(h->avctx, AV_LOG_ERROR, "AVC: nal size %d\n", nalsize);
189                 break;
190             }
191             src_length = nalsize;
192         } else {
193         buf = avpriv_find_start_code(buf, buf_end, &state);
194         if (buf >= buf_end)
195             break;
196         --buf;
197         src_length = buf_end - buf;
198         }
199         switch (state & 0x1f) {
200         case NAL_SLICE:
201         case NAL_IDR_SLICE:
202             // Do not walk the whole buffer just to decode slice header
203             if (src_length > 20)
204                 src_length = 20;
205             break;
206         }
207         ptr = ff_h264_decode_nal(h, buf, &dst_length, &consumed, src_length);
208         if (ptr == NULL || dst_length < 0)
209             break;
210
211         init_get_bits(&h->gb, ptr, 8 * dst_length);
212         switch (h->nal_unit_type) {
213         case NAL_SPS:
214             ff_h264_decode_seq_parameter_set(h);
215             break;
216         case NAL_PPS:
217             ff_h264_decode_picture_parameter_set(h, h->gb.size_in_bits);
218             break;
219         case NAL_SEI:
220             ff_h264_decode_sei(h);
221             break;
222         case NAL_IDR_SLICE:
223             s->key_frame = 1;
224
225             h->prev_frame_num        = 0;
226             h->prev_frame_num_offset = 0;
227             h->prev_poc_msb          =
228             h->prev_poc_lsb          = 0;
229         /* fall through */
230         case NAL_SLICE:
231             get_ue_golomb_long(&h->gb);  // skip first_mb_in_slice
232             slice_type   = get_ue_golomb_31(&h->gb);
233             s->pict_type = golomb_to_pict_type[slice_type % 5];
234             if (h->sei_recovery_frame_cnt >= 0) {
235                 /* key frame, since recovery_frame_cnt is set */
236                 s->key_frame = 1;
237             }
238             pps_id = get_ue_golomb(&h->gb);
239             if (pps_id >= MAX_PPS_COUNT) {
240                 av_log(h->avctx, AV_LOG_ERROR,
241                        "pps_id out of range\n");
242                 return -1;
243             }
244             if (!h->pps_buffers[pps_id]) {
245                 av_log(h->avctx, AV_LOG_ERROR,
246                        "non-existing PPS referenced\n");
247                 return -1;
248             }
249             h->pps = *h->pps_buffers[pps_id];
250             if (!h->sps_buffers[h->pps.sps_id]) {
251                 av_log(h->avctx, AV_LOG_ERROR,
252                        "non-existing SPS referenced\n");
253                 return -1;
254             }
255             h->sps       = *h->sps_buffers[h->pps.sps_id];
256             h->frame_num = get_bits(&h->gb, h->sps.log2_max_frame_num);
257
258             avctx->profile = ff_h264_get_profile(&h->sps);
259             avctx->level   = h->sps.level_idc;
260
261             if (h->sps.frame_mbs_only_flag) {
262                 h->picture_structure = PICT_FRAME;
263             } else {
264                 if (get_bits1(&h->gb)) { // field_pic_flag
265                     h->picture_structure = PICT_TOP_FIELD + get_bits1(&h->gb); // bottom_field_flag
266                 } else {
267                     h->picture_structure = PICT_FRAME;
268                 }
269             }
270
271             if (h->nal_unit_type == NAL_IDR_SLICE)
272                 get_ue_golomb(&h->gb); /* idr_pic_id */
273             if (h->sps.poc_type == 0) {
274                 h->poc_lsb = get_bits(&h->gb, h->sps.log2_max_poc_lsb);
275
276                 if (h->pps.pic_order_present == 1 &&
277                     h->picture_structure == PICT_FRAME)
278                     h->delta_poc_bottom = get_se_golomb(&h->gb);
279             }
280
281             if (h->sps.poc_type == 1 &&
282                 !h->sps.delta_pic_order_always_zero_flag) {
283                 h->delta_poc[0] = get_se_golomb(&h->gb);
284
285                 if (h->pps.pic_order_present == 1 &&
286                     h->picture_structure == PICT_FRAME)
287                     h->delta_poc[1] = get_se_golomb(&h->gb);
288             }
289
290             ff_init_poc(h, field_poc, NULL);
291
292             if (h->sps.pic_struct_present_flag) {
293                 switch (h->sei_pic_struct) {
294                 case SEI_PIC_STRUCT_TOP_FIELD:
295                 case SEI_PIC_STRUCT_BOTTOM_FIELD:
296                     s->repeat_pict = 0;
297                     break;
298                 case SEI_PIC_STRUCT_FRAME:
299                 case SEI_PIC_STRUCT_TOP_BOTTOM:
300                 case SEI_PIC_STRUCT_BOTTOM_TOP:
301                     s->repeat_pict = 1;
302                     break;
303                 case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:
304                 case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:
305                     s->repeat_pict = 2;
306                     break;
307                 case SEI_PIC_STRUCT_FRAME_DOUBLING:
308                     s->repeat_pict = 3;
309                     break;
310                 case SEI_PIC_STRUCT_FRAME_TRIPLING:
311                     s->repeat_pict = 5;
312                     break;
313                 default:
314                     s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;
315                     break;
316                 }
317             } else {
318                 s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;
319             }
320
321             if (h->picture_structure == PICT_FRAME) {
322                 s->picture_structure = AV_PICTURE_STRUCTURE_FRAME;
323                 if (h->sps.pic_struct_present_flag) {
324                     switch (h->sei_pic_struct) {
325                     case SEI_PIC_STRUCT_TOP_BOTTOM:
326                     case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:
327                         s->field_order = AV_FIELD_TT;
328                         break;
329                     case SEI_PIC_STRUCT_BOTTOM_TOP:
330                     case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:
331                         s->field_order = AV_FIELD_BB;
332                         break;
333                     default:
334                         s->field_order = AV_FIELD_PROGRESSIVE;
335                         break;
336                     }
337                 } else {
338                     if (field_poc[0] < field_poc[1])
339                         s->field_order = AV_FIELD_TT;
340                     else if (field_poc[0] > field_poc[1])
341                         s->field_order = AV_FIELD_BB;
342                     else
343                         s->field_order = AV_FIELD_PROGRESSIVE;
344                 }
345             } else {
346                 if (h->picture_structure == PICT_TOP_FIELD)
347                     s->picture_structure = AV_PICTURE_STRUCTURE_TOP_FIELD;
348                 else
349                     s->picture_structure = AV_PICTURE_STRUCTURE_BOTTOM_FIELD;
350                 s->field_order = AV_FIELD_UNKNOWN;
351             }
352
353             return 0; /* no need to evaluate the rest */
354         }
355         buf += h->is_avc ? nalsize : consumed;
356     }
357     if (q264)
358         return 0;
359     /* didn't find a picture! */
360     av_log(h->avctx, AV_LOG_ERROR, "missing picture in access unit with size %d\n", buf_size);
361     return -1;
362 }
363
364 static int h264_parse(AVCodecParserContext *s,
365                       AVCodecContext *avctx,
366                       const uint8_t **poutbuf, int *poutbuf_size,
367                       const uint8_t *buf, int buf_size)
368 {
369     H264Context *h   = s->priv_data;
370     ParseContext *pc = &h->parse_context;
371     int next;
372
373     if (!h->got_first) {
374         h->got_first = 1;
375         if (avctx->extradata_size) {
376             h->avctx = avctx;
377             // must be done like in decoder, otherwise opening the parser,
378             // letting it create extradata and then closing and opening again
379             // will cause has_b_frames to be always set.
380             // Note that estimate_timings_from_pts does exactly this.
381             if (!avctx->has_b_frames)
382                 h->low_delay = 1;
383             ff_h264_decode_extradata(h, avctx->extradata, avctx->extradata_size);
384         }
385     }
386
387     if (s->flags & PARSER_FLAG_COMPLETE_FRAMES) {
388         next = buf_size;
389     } else {
390         next = h264_find_frame_end(h, buf, buf_size);
391
392         if (ff_combine_frame(pc, next, &buf, &buf_size) < 0) {
393             *poutbuf      = NULL;
394             *poutbuf_size = 0;
395             return buf_size;
396         }
397
398         if (next < 0 && next != END_NOT_FOUND) {
399             av_assert1(pc->last_index + next >= 0);
400             h264_find_frame_end(h, &pc->buffer[pc->last_index + next], -next); // update state
401         }
402     }
403
404     parse_nal_units(s, avctx, buf, buf_size);
405
406     if (h->sei_cpb_removal_delay >= 0) {
407         s->dts_sync_point    = h->sei_buffering_period_present;
408         s->dts_ref_dts_delta = h->sei_cpb_removal_delay;
409         s->pts_dts_delta     = h->sei_dpb_output_delay;
410     } else {
411         s->dts_sync_point    = INT_MIN;
412         s->dts_ref_dts_delta = INT_MIN;
413         s->pts_dts_delta     = INT_MIN;
414     }
415
416     if (s->flags & PARSER_FLAG_ONCE) {
417         s->flags &= PARSER_FLAG_COMPLETE_FRAMES;
418     }
419
420     *poutbuf      = buf;
421     *poutbuf_size = buf_size;
422     return next;
423 }
424
425 static int h264_split(AVCodecContext *avctx,
426                       const uint8_t *buf, int buf_size)
427 {
428     int i;
429     uint32_t state = -1;
430     int has_sps    = 0;
431
432     for (i = 0; i <= buf_size; i++) {
433         if ((state & 0xFFFFFF1F) == 0x107)
434             has_sps = 1;
435         /*  if ((state&0xFFFFFF1F) == 0x101 ||
436          *     (state&0xFFFFFF1F) == 0x102 ||
437          *     (state&0xFFFFFF1F) == 0x105) {
438          *  }
439          */
440         if ((state & 0xFFFFFF00) == 0x100 && (state & 0xFFFFFF1F) != 0x107 &&
441             (state & 0xFFFFFF1F) != 0x108 && (state & 0xFFFFFF1F) != 0x109) {
442             if (has_sps) {
443                 while (i > 4 && buf[i - 5] == 0)
444                     i--;
445                 return i - 4;
446             }
447         }
448         if (i < buf_size)
449             state = (state << 8) | buf[i];
450     }
451     return 0;
452 }
453
454 static void close(AVCodecParserContext *s)
455 {
456     H264Context *h   = s->priv_data;
457     ParseContext *pc = &h->parse_context;
458
459     av_free(pc->buffer);
460     ff_h264_free_context(h);
461 }
462
463 static av_cold int init(AVCodecParserContext *s)
464 {
465     H264Context *h = s->priv_data;
466     h->thread_context[0]   = h;
467     h->slice_context_count = 1;
468     return 0;
469 }
470
471 AVCodecParser ff_h264_parser = {
472     .codec_ids      = { AV_CODEC_ID_H264 },
473     .priv_data_size = sizeof(H264Context),
474     .parser_init    = init,
475     .parser_parse   = h264_parse,
476     .parser_close   = close,
477     .split          = h264_split,
478 };