]> git.sesse.net Git - ffmpeg/blob - libavcodec/h264_sei.c
exr: make sure that data_size is not bigger than expected
[ffmpeg] / libavcodec / h264_sei.c
1 /*
2  * H.26L/H.264/AVC/JVT/14496-10/... sei decoding
3  * Copyright (c) 2003 Michael Niedermayer <michaelni@gmx.at>
4  *
5  * This file is part of FFmpeg.
6  *
7  * FFmpeg is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * FFmpeg is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with FFmpeg; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20  */
21
22 /**
23  * @file
24  * H.264 / AVC / MPEG4 part10 sei decoding.
25  * @author Michael Niedermayer <michaelni@gmx.at>
26  */
27
28 #include "internal.h"
29 #include "avcodec.h"
30 #include "h264.h"
31 #include "golomb.h"
32
33 //#undef NDEBUG
34 #include <assert.h>
35
36 static const uint8_t sei_num_clock_ts_table[9]={
37     1,  1,  1,  2,  2,  3,  3,  2,  3
38 };
39
40 void ff_h264_reset_sei(H264Context *h) {
41     h->sei_recovery_frame_cnt       = -1;
42     h->sei_dpb_output_delay         =  0;
43     h->sei_cpb_removal_delay        = -1;
44     h->sei_buffering_period_present =  0;
45 }
46
47 static int decode_picture_timing(H264Context *h){
48     if(h->sps.nal_hrd_parameters_present_flag || h->sps.vcl_hrd_parameters_present_flag){
49         h->sei_cpb_removal_delay = get_bits_long(&h->gb, h->sps.cpb_removal_delay_length);
50         h->sei_dpb_output_delay = get_bits_long(&h->gb, h->sps.dpb_output_delay_length);
51     }
52     if(h->sps.pic_struct_present_flag){
53         unsigned int i, num_clock_ts;
54         h->sei_pic_struct = get_bits(&h->gb, 4);
55         h->sei_ct_type    = 0;
56
57         if (h->sei_pic_struct > SEI_PIC_STRUCT_FRAME_TRIPLING)
58             return -1;
59
60         num_clock_ts = sei_num_clock_ts_table[h->sei_pic_struct];
61
62         for (i = 0 ; i < num_clock_ts ; i++){
63             if(get_bits(&h->gb, 1)){                  /* clock_timestamp_flag */
64                 unsigned int full_timestamp_flag;
65                 h->sei_ct_type |= 1<<get_bits(&h->gb, 2);
66                 skip_bits(&h->gb, 1);                 /* nuit_field_based_flag */
67                 skip_bits(&h->gb, 5);                 /* counting_type */
68                 full_timestamp_flag = get_bits(&h->gb, 1);
69                 skip_bits(&h->gb, 1);                 /* discontinuity_flag */
70                 skip_bits(&h->gb, 1);                 /* cnt_dropped_flag */
71                 skip_bits(&h->gb, 8);                 /* n_frames */
72                 if(full_timestamp_flag){
73                     skip_bits(&h->gb, 6);             /* seconds_value 0..59 */
74                     skip_bits(&h->gb, 6);             /* minutes_value 0..59 */
75                     skip_bits(&h->gb, 5);             /* hours_value 0..23 */
76                 }else{
77                     if(get_bits(&h->gb, 1)){          /* seconds_flag */
78                         skip_bits(&h->gb, 6);         /* seconds_value range 0..59 */
79                         if(get_bits(&h->gb, 1)){      /* minutes_flag */
80                             skip_bits(&h->gb, 6);     /* minutes_value 0..59 */
81                             if(get_bits(&h->gb, 1))   /* hours_flag */
82                                 skip_bits(&h->gb, 5); /* hours_value 0..23 */
83                         }
84                     }
85                 }
86                 if(h->sps.time_offset_length > 0)
87                     skip_bits(&h->gb, h->sps.time_offset_length); /* time_offset */
88             }
89         }
90
91         if(h->avctx->debug & FF_DEBUG_PICT_INFO)
92             av_log(h->avctx, AV_LOG_DEBUG, "ct_type:%X pic_struct:%d\n", h->sei_ct_type, h->sei_pic_struct);
93     }
94     return 0;
95 }
96
97 static int decode_user_data_itu_t_t35(H264Context *h, int size) {
98     uint32_t user_identifier;
99     int dtg_active_format;
100
101     if (size < 7)
102         return -1;
103     size -= 7;
104
105     skip_bits(&h->gb, 8);   // country_code
106     skip_bits(&h->gb, 16);  // provider_code
107     user_identifier = get_bits_long(&h->gb, 32);
108
109     switch (user_identifier) {
110         case 0x44544731:    // "DTG1" - AFD_data
111             if (size < 1)
112                 return -1;
113             skip_bits(&h->gb, 1);
114             if (get_bits(&h->gb, 1)) {
115                 skip_bits(&h->gb, 6);
116                 if (size < 2)
117                     return -1;
118                 skip_bits(&h->gb, 4);
119                 dtg_active_format = get_bits(&h->gb, 4);
120                 h->avctx->dtg_active_format = dtg_active_format;
121             } else {
122                 skip_bits(&h->gb, 6);
123             }
124             break;
125         default:
126             skip_bits(&h->gb, size * 8);
127             break;
128     }
129
130     return 0;
131 }
132
133 static int decode_unregistered_user_data(H264Context *h, int size){
134     uint8_t user_data[16+256];
135     int e, build, i;
136
137     if(size<16)
138         return -1;
139
140     for(i=0; i<sizeof(user_data)-1 && i<size; i++){
141         user_data[i]= get_bits(&h->gb, 8);
142     }
143
144     user_data[i]= 0;
145     e= sscanf(user_data+16, "x264 - core %d"/*%s - H.264/MPEG-4 AVC codec - Copyleft 2005 - http://www.videolan.org/x264.html*/, &build);
146     if(e==1 && build>0)
147         h->x264_build= build;
148     if(e==1 && build==1 && !strncmp(user_data+16, "x264 - core 0000", 16))
149         h->x264_build = 67;
150
151     if(h->avctx->debug & FF_DEBUG_BUGS)
152         av_log(h->avctx, AV_LOG_DEBUG, "user data:\"%s\"\n", user_data+16);
153
154     for(; i<size; i++)
155         skip_bits(&h->gb, 8);
156
157     return 0;
158 }
159
160 static int decode_recovery_point(H264Context *h){
161     h->sei_recovery_frame_cnt = get_ue_golomb(&h->gb);
162     skip_bits(&h->gb, 4);       /* 1b exact_match_flag, 1b broken_link_flag, 2b changing_slice_group_idc */
163
164     return 0;
165 }
166
167 static int decode_buffering_period(H264Context *h){
168     unsigned int sps_id;
169     int sched_sel_idx;
170     SPS *sps;
171
172     sps_id = get_ue_golomb_31(&h->gb);
173     if(sps_id > 31 || !h->sps_buffers[sps_id]) {
174         av_log(h->avctx, AV_LOG_ERROR, "non-existing SPS %d referenced in buffering period\n", sps_id);
175         return -1;
176     }
177     sps = h->sps_buffers[sps_id];
178
179     // NOTE: This is really so duplicated in the standard... See H.264, D.1.1
180     if (sps->nal_hrd_parameters_present_flag) {
181         for (sched_sel_idx = 0; sched_sel_idx < sps->cpb_cnt; sched_sel_idx++) {
182             h->initial_cpb_removal_delay[sched_sel_idx] = get_bits_long(&h->gb, sps->initial_cpb_removal_delay_length);
183             skip_bits(&h->gb, sps->initial_cpb_removal_delay_length); // initial_cpb_removal_delay_offset
184         }
185     }
186     if (sps->vcl_hrd_parameters_present_flag) {
187         for (sched_sel_idx = 0; sched_sel_idx < sps->cpb_cnt; sched_sel_idx++) {
188             h->initial_cpb_removal_delay[sched_sel_idx] = get_bits_long(&h->gb, sps->initial_cpb_removal_delay_length);
189             skip_bits(&h->gb, sps->initial_cpb_removal_delay_length); // initial_cpb_removal_delay_offset
190         }
191     }
192
193     h->sei_buffering_period_present = 1;
194     return 0;
195 }
196
197 int ff_h264_decode_sei(H264Context *h){
198     while (get_bits_left(&h->gb) > 16) {
199         int size, type;
200
201         type=0;
202         do{
203             if (get_bits_left(&h->gb) < 8)
204                 return -1;
205             type+= show_bits(&h->gb, 8);
206         }while(get_bits(&h->gb, 8) == 255);
207
208         size=0;
209         do{
210             if (get_bits_left(&h->gb) < 8)
211                 return -1;
212             size+= show_bits(&h->gb, 8);
213         }while(get_bits(&h->gb, 8) == 255);
214
215         if(h->avctx->debug&FF_DEBUG_STARTCODE)
216             av_log(h->avctx, AV_LOG_DEBUG, "SEI %d len:%d\n", type, size);
217
218         switch(type){
219         case SEI_TYPE_PIC_TIMING: // Picture timing SEI
220             if(decode_picture_timing(h) < 0)
221                 return -1;
222             break;
223         case SEI_TYPE_USER_DATA_ITU_T_T35:
224             if(decode_user_data_itu_t_t35(h, size) < 0)
225                 return -1;
226             break;
227         case SEI_TYPE_USER_DATA_UNREGISTERED:
228             if(decode_unregistered_user_data(h, size) < 0)
229                 return -1;
230             break;
231         case SEI_TYPE_RECOVERY_POINT:
232             if(decode_recovery_point(h) < 0)
233                 return -1;
234             break;
235         case SEI_BUFFERING_PERIOD:
236             if(decode_buffering_period(h) < 0)
237                 return -1;
238             break;
239         default:
240             skip_bits(&h->gb, 8*size);
241         }
242
243         //FIXME check bits here
244         align_get_bits(&h->gb);
245     }
246
247     return 0;
248 }