]> git.sesse.net Git - ffmpeg/blob - libavcodec/shorten.c
sanity checks, some might have been exploitable ...
[ffmpeg] / libavcodec / shorten.c
1 /*
2  * Shorten decoder
3  * Copyright (c) 2005 Jeff Muizelaar
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the Free Software
17  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
18  */
19
20 /**
21  * @file shorten.c
22  * Shorten decoder
23  * @author Jeff Muizelaar
24  *
25  */
26
27 #define DEBUG
28 #include <limits.h>
29 #include "avcodec.h"
30 #include "bitstream.h"
31 #include "golomb.h"
32
33 #define MAX_CHANNELS 8
34 #define MAX_BLOCKSIZE 65535
35
36 #define OUT_BUFFER_SIZE 16384
37
38 #define ULONGSIZE 2
39
40 #define WAVE_FORMAT_PCM 0x0001
41
42 #define DEFAULT_BLOCK_SIZE 256
43
44 #define TYPESIZE 4
45 #define CHANSIZE 0
46 #define LPCQSIZE 2
47 #define ENERGYSIZE 3
48 #define BITSHIFTSIZE 2
49
50 #define TYPE_S16HL 3
51 #define TYPE_S16LH 5
52
53 #define NWRAP 3
54 #define NSKIPSIZE 1
55
56 #define LPCQUANT 5
57 #define V2LPCQOFFSET (1 << LPCQUANT)
58
59 #define FNSIZE 2
60 #define FN_DIFF0        0
61 #define FN_DIFF1        1
62 #define FN_DIFF2        2
63 #define FN_DIFF3        3
64 #define FN_QUIT         4
65 #define FN_BLOCKSIZE    5
66 #define FN_BITSHIFT     6
67 #define FN_QLPC         7
68 #define FN_ZERO         8
69 #define FN_VERBATIM     9
70
71 #define VERBATIM_CKSIZE_SIZE 5
72 #define VERBATIM_BYTE_SIZE 8
73 #define CANONICAL_HEADER_SIZE 44
74
75 typedef struct ShortenContext {
76     AVCodecContext *avctx;
77     GetBitContext gb;
78
79     int min_framesize, max_framesize;
80     int channels;
81
82     int32_t *decoded[MAX_CHANNELS];
83     int32_t *offset[MAX_CHANNELS];
84     uint8_t *bitstream;
85     int bitstream_size;
86     int bitstream_index;
87     unsigned int allocated_bitstream_size;
88     int header_size;
89     uint8_t header[OUT_BUFFER_SIZE];
90     int version;
91     int cur_chan;
92     int bitshift;
93     int nmean;
94     int internal_ftype;
95     int nwrap;
96     int blocksize;
97     int bitindex;
98     int32_t lpcqoffset;
99 } ShortenContext;
100
101 static int shorten_decode_init(AVCodecContext * avctx)
102 {
103     ShortenContext *s = avctx->priv_data;
104     s->avctx = avctx;
105
106     return 0;
107 }
108
109 static int allocate_buffers(ShortenContext *s)
110 {
111     int i, chan;
112     for (chan=0; chan<s->channels; chan++) {
113         if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){
114             av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n");
115             return -1;
116         }
117         if(s->blocksize + s->nwrap >= UINT_MAX/sizeof(int32_t) || s->blocksize + s->nwrap <= (unsigned)s->nwrap){
118             av_log(s->avctx, AV_LOG_ERROR, "s->blocksize + s->nwrap too large\n");
119             return -1;
120         }
121
122         s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
123
124         s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
125         for (i=0; i<s->nwrap; i++)
126             s->decoded[chan][i] = 0;
127         s->decoded[chan] += s->nwrap;
128     }
129     return 0;
130 }
131
132
133 static inline unsigned int get_uint(ShortenContext *s, int k)
134 {
135     if (s->version != 0)
136         k = get_ur_golomb_shorten(&s->gb, ULONGSIZE);
137     return get_ur_golomb_shorten(&s->gb, k);
138 }
139
140
141 static void fix_bitshift(ShortenContext *s, int32_t *buffer)
142 {
143     int i;
144
145     if (s->bitshift != 0)
146         for (i = 0; i < s->blocksize; i++)
147             buffer[s->nwrap + i] <<= s->bitshift;
148 }
149
150
151 static void init_offset(ShortenContext *s)
152 {
153     int32_t mean = 0;
154     int  chan, i;
155     int nblock = FFMAX(1, s->nmean);
156     /* initialise offset */
157     switch (s->internal_ftype)
158     {
159         case TYPE_S16HL:
160         case TYPE_S16LH:
161             mean = 0;
162             break;
163         default:
164             av_log(s->avctx, AV_LOG_ERROR, "unknown audio type");
165             abort();
166     }
167
168     for (chan = 0; chan < s->channels; chan++)
169         for (i = 0; i < nblock; i++)
170             s->offset[chan][i] = mean;
171 }
172
173 static int inline get_le32(GetBitContext *gb)
174 {
175     return bswap_32(get_bits_long(gb, 32));
176 }
177
178 static short inline get_le16(GetBitContext *gb)
179 {
180     return bswap_16(get_bits_long(gb, 16));
181 }
182
183 static int decode_wave_header(AVCodecContext *avctx, uint8_t *header, int header_size)
184 {
185     GetBitContext hb;
186     int len;
187     int chunk_size;
188     short wave_format;
189
190     init_get_bits(&hb, header, header_size*8);
191     if (get_le32(&hb) != MKTAG('R','I','F','F')) {
192         av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n");
193         return -1;
194     }
195
196     chunk_size = get_le32(&hb);
197
198     if (get_le32(&hb) != MKTAG('W','A','V','E')) {
199         av_log(avctx, AV_LOG_ERROR, "missing WAVE tag\n");
200         return -1;
201     }
202
203     while (get_le32(&hb) != MKTAG('f','m','t',' ')) {
204         len = get_le32(&hb);
205         skip_bits(&hb, 8*len);
206     }
207     len = get_le32(&hb);
208
209     if (len < 16) {
210         av_log(avctx, AV_LOG_ERROR, "fmt chunk was too short\n");
211         return -1;
212     }
213
214     wave_format = get_le16(&hb);
215
216     switch (wave_format) {
217         case WAVE_FORMAT_PCM:
218             break;
219         default:
220             av_log(avctx, AV_LOG_ERROR, "unsupported wave format\n");
221             return -1;
222     }
223
224     avctx->channels = get_le16(&hb);
225     avctx->sample_rate = get_le32(&hb);
226     avctx->bit_rate = get_le32(&hb) * 8;
227     avctx->block_align = get_le16(&hb);
228     avctx->bits_per_sample = get_le16(&hb);
229
230     if (avctx->bits_per_sample != 16) {
231         av_log(avctx, AV_LOG_ERROR, "unsupported number of bits per sample\n");
232         return -1;
233     }
234
235     len -= 16;
236     if (len > 0)
237         av_log(avctx, AV_LOG_INFO, "%d header bytes unparsed\n", len);
238
239     return 0;
240 }
241
242 static int16_t * interleave_buffer(int16_t *samples, int nchan, int blocksize, int32_t **buffer) {
243     int i, chan;
244     for (i=0; i<blocksize; i++)
245         for (chan=0; chan < nchan; chan++)
246             *samples++ = FFMIN(buffer[chan][i], 32768);
247     return samples;
248 }
249
250 static void decode_subframe_lpc(ShortenContext *s, int channel, int residual_size, int pred_order)
251 {
252     int sum, i, j;
253     int coeffs[pred_order];
254
255     for (i=0; i<pred_order; i++)
256         coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);
257
258     for (i=0; i < s->blocksize; i++) {
259         sum = s->lpcqoffset;
260         for (j=0; j<pred_order; j++)
261             sum += coeffs[j] * s->decoded[channel][i-j-1];
262         s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + (sum >> LPCQUANT);
263     }
264 }
265
266
267 static int shorten_decode_frame(AVCodecContext *avctx,
268         void *data, int *data_size,
269         uint8_t *buf, int buf_size)
270 {
271     ShortenContext *s = avctx->priv_data;
272     int i, input_buf_size = 0;
273     int16_t *samples = data;
274     if(s->max_framesize == 0){
275         s->max_framesize= 1024; // should hopefully be enough for the first header
276         s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
277     }
278
279     if(1 && s->max_framesize){//FIXME truncated
280         buf_size= FFMIN(buf_size, s->max_framesize - s->bitstream_size);
281         input_buf_size= buf_size;
282
283         if(s->bitstream_index + s->bitstream_size + buf_size > s->allocated_bitstream_size){
284             //                printf("memmove\n");
285             memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size);
286             s->bitstream_index=0;
287         }
288         memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], buf, buf_size);
289         buf= &s->bitstream[s->bitstream_index];
290         buf_size += s->bitstream_size;
291         s->bitstream_size= buf_size;
292
293         if(buf_size < s->max_framesize){
294             //dprintf("wanna more data ... %d\n", buf_size);
295             return input_buf_size;
296         }
297     }
298     init_get_bits(&s->gb, buf, buf_size*8);
299     get_bits(&s->gb, s->bitindex);
300     if (!s->blocksize)
301     {
302         int maxnlpc = 0;
303         /* shorten signature */
304         if (get_bits_long(&s->gb, 32) != bswap_32(ff_get_fourcc("ajkg"))) {
305             av_log(s->avctx, AV_LOG_ERROR, "missing shorten magic 'ajkg'\n");
306             return -1;
307         }
308
309         s->lpcqoffset = 0;
310         s->blocksize = DEFAULT_BLOCK_SIZE;
311         s->channels = 1;
312         s->nmean = -1;
313         s->version = get_bits(&s->gb, 8);
314         s->internal_ftype = get_uint(s, TYPESIZE);
315
316         s->channels = get_uint(s, CHANSIZE);
317         if (s->channels > MAX_CHANNELS) {
318             av_log(s->avctx, AV_LOG_ERROR, "too many channels: %d\n", s->channels);
319             return -1;
320         }
321
322         /* get blocksize if version > 0 */
323         if (s->version > 0) {
324             int skip_bytes;
325             s->blocksize = get_uint(s, av_log2(DEFAULT_BLOCK_SIZE));
326             maxnlpc = get_uint(s, LPCQSIZE);
327             s->nmean = get_uint(s, 0);
328
329             skip_bytes = get_uint(s, NSKIPSIZE);
330             for (i=0; i<skip_bytes; i++) {
331                 skip_bits(&s->gb, 8);
332             }
333         }
334         s->nwrap = FFMAX(NWRAP, maxnlpc);
335
336         allocate_buffers(s);
337
338         init_offset(s);
339
340         if (s->version > 1)
341             s->lpcqoffset = V2LPCQOFFSET;
342
343         if (get_ur_golomb_shorten(&s->gb, FNSIZE) != FN_VERBATIM) {
344             av_log(s->avctx, AV_LOG_ERROR, "missing verbatim section at begining of stream\n");
345             return -1;
346         }
347
348         s->header_size = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
349         if (s->header_size >= OUT_BUFFER_SIZE || s->header_size < CANONICAL_HEADER_SIZE) {
350             av_log(s->avctx, AV_LOG_ERROR, "header is wrong size: %d\n", s->header_size);
351             return -1;
352         }
353
354         for (i=0; i<s->header_size; i++)
355             s->header[i] = (char)get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
356
357         if (decode_wave_header(avctx, s->header, s->header_size) < 0)
358             return -1;
359
360         s->cur_chan = 0;
361         s->bitshift = 0;
362     }
363     else
364     {
365         int cmd;
366         int len;
367         cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);
368         switch (cmd) {
369             case FN_ZERO:
370             case FN_DIFF0:
371             case FN_DIFF1:
372             case FN_DIFF2:
373             case FN_DIFF3:
374             case FN_QLPC:
375                 {
376                     int residual_size = 0;
377                     int channel = s->cur_chan;
378                     int32_t coffset;
379                     if (cmd != FN_ZERO) {
380                         residual_size = get_ur_golomb_shorten(&s->gb, ENERGYSIZE);
381                         /* this is a hack as version 0 differed in defintion of get_sr_golomb_shorten */
382                         if (s->version == 0)
383                             residual_size--;
384                     }
385
386                     if (s->nmean == 0)
387                         coffset = s->offset[channel][0];
388                     else {
389                         int32_t sum = (s->version < 2) ? 0 : s->nmean / 2;
390                         for (i=0; i<s->nmean; i++)
391                             sum += s->offset[channel][i];
392                         coffset = sum / s->nmean;
393                         if (s->version >= 2)
394                             coffset >>= FFMIN(1, s->bitshift);
395                     }
396                     switch (cmd) {
397                         case FN_ZERO:
398                             for (i=0; i<s->blocksize; i++)
399                                 s->decoded[channel][i] = 0;
400                             break;
401                         case FN_DIFF0:
402                             for (i=0; i<s->blocksize; i++)
403                                 s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + coffset;
404                             break;
405                         case FN_DIFF1:
406                             for (i=0; i<s->blocksize; i++)
407                                 s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + s->decoded[channel][i - 1];
408                             break;
409                         case FN_DIFF2:
410                             for (i=0; i<s->blocksize; i++)
411                                 s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + 2*s->decoded[channel][i-1]
412                                                                                                       -   s->decoded[channel][i-2];
413                             break;
414                         case FN_DIFF3:
415                             for (i=0; i<s->blocksize; i++)
416                                 s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + 3*s->decoded[channel][i-1]
417                                                                                                       - 3*s->decoded[channel][i-2]
418                                                                                                       +   s->decoded[channel][i-3];
419                             break;
420                         case FN_QLPC:
421                             {
422                                 int pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);
423                                 for (i=0; i<pred_order; i++)
424                                     s->decoded[channel][i - pred_order] -= coffset;
425                                 decode_subframe_lpc(s, channel, residual_size, pred_order);
426                                 if (coffset != 0)
427                                     for (i=0; i < s->blocksize; i++)
428                                         s->decoded[channel][i] += coffset;
429                             }
430                     }
431                     if (s->nmean > 0) {
432                         int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2;
433                         for (i=0; i<s->blocksize; i++)
434                             sum += s->decoded[channel][i];
435
436                         for (i=1; i<s->nmean; i++)
437                             s->offset[channel][i-1] = s->offset[channel][i];
438
439                         if (s->version < 2)
440                             s->offset[channel][s->nmean - 1] = sum / s->blocksize;
441                         else
442                             s->offset[channel][s->nmean - 1] = (sum / s->blocksize) << s->bitshift;
443                     }
444                     for (i=-s->nwrap; i<0; i++)
445                         s->decoded[channel][i] = s->decoded[channel][i + s->blocksize];
446
447                     fix_bitshift(s, s->decoded[channel]);
448
449                     s->cur_chan++;
450                     if (s->cur_chan == s->channels) {
451                         samples = interleave_buffer(samples, s->channels, s->blocksize, s->decoded);
452                         s->cur_chan = 0;
453                         goto frame_done;
454                     }
455                     break;
456                 }
457                 break;
458             case FN_VERBATIM:
459                 len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
460                 while (len--) {
461                     get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
462                 }
463                 break;
464             case FN_BITSHIFT:
465                 s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
466                 break;
467             case FN_BLOCKSIZE:
468                 s->blocksize = get_uint(s, av_log2(s->blocksize));
469                 break;
470             case FN_QUIT:
471                 return buf_size;
472                 break;
473             default:
474                 av_log(avctx, AV_LOG_ERROR, "unknown shorten function %d\n", cmd);
475                 return -1;
476                 break;
477         }
478     }
479 frame_done:
480     *data_size = (int8_t *)samples - (int8_t *)data;
481
482     //    s->last_blocksize = s->blocksize;
483     s->bitindex = get_bits_count(&s->gb) - 8*((get_bits_count(&s->gb))/8);
484     i= (get_bits_count(&s->gb))/8;
485     if (i > buf_size) {
486         av_log(s->avctx, AV_LOG_ERROR, "overread: %d\n", i - buf_size);
487         s->bitstream_size=0;
488         s->bitstream_index=0;
489         return -1;
490     }
491     if (s->bitstream_size) {
492         s->bitstream_index += i;
493         s->bitstream_size  -= i;
494         return input_buf_size;
495     } else
496         return i;
497 }
498
499 static int shorten_decode_close(AVCodecContext *avctx)
500 {
501     ShortenContext *s = avctx->priv_data;
502     int i;
503
504     for (i = 0; i < s->channels; i++) {
505         s->decoded[i] -= s->nwrap;
506         av_freep(&s->decoded[i]);
507         av_freep(&s->offset[i]);
508     }
509     av_freep(&s->bitstream);
510     return 0;
511 }
512
513 static void shorten_flush(AVCodecContext *avctx){
514     ShortenContext *s = avctx->priv_data;
515
516     s->bitstream_size=
517         s->bitstream_index= 0;
518 }
519
520 AVCodec shorten_decoder = {
521     "shorten",
522     CODEC_TYPE_AUDIO,
523     CODEC_ID_SHORTEN,
524     sizeof(ShortenContext),
525     shorten_decode_init,
526     NULL,
527     shorten_decode_close,
528     shorten_decode_frame,
529     .flush= shorten_flush,
530 };