3 * Copyright (c) 2006 Konstantin Shishkov
5 * This file is part of FFmpeg.
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
28 * Based on http://wiki.multimedia.cx/index.php?title=Smacker
34 #include "libavutil/channel_layout.h"
38 #define SMKTREE_BITS 9
39 #define SMK_NODE 0x80000000
41 #define SMKTREE_DECODE_MAX_RECURSION FFMIN(32, 3 * SMKTREE_BITS)
42 #define SMKTREE_DECODE_BIG_MAX_RECURSION 500
44 /* The maximum possible unchecked overread happens in decode_header_trees:
45 * Decoding the MMAP tree can overread by 6 * SMKTREE_BITS + 1, followed by
46 * three get_bits1, followed by at most 2 + 3 * 16 read bits when reading
47 * the TYPE tree before the next check. 64 is because of 64 bit reads. */
48 #if (6 * SMKTREE_BITS + 1 + 3 + (2 + 3 * 16) + 64) <= 8 * AV_INPUT_BUFFER_PADDING_SIZE
49 #define UNCHECKED_BITSTREAM_READER 1
51 #define BITSTREAM_READER_LE
52 #include "bytestream.h"
57 typedef struct SmackVContext {
58 AVCodecContext *avctx;
61 int *mmap_tbl, *mclr_tbl, *full_tbl, *type_tbl;
62 int mmap_last[3], mclr_last[3], full_last[3], type_last[3];
66 * Context used for code reconstructing
68 typedef struct HuffContext {
76 /* common parameters used for decode_bigtree */
77 typedef struct DBCtx {
79 int *recode1, *recode2;
84 /* possible runs of blocks */
85 static const int block_runs[64] = {
86 1, 2, 3, 4, 5, 6, 7, 8,
87 9, 10, 11, 12, 13, 14, 15, 16,
88 17, 18, 19, 20, 21, 22, 23, 24,
89 25, 26, 27, 28, 29, 30, 31, 32,
90 33, 34, 35, 36, 37, 38, 39, 40,
91 41, 42, 43, 44, 45, 46, 47, 48,
92 49, 50, 51, 52, 53, 54, 55, 56,
93 57, 58, 59, 128, 256, 512, 1024, 2048 };
102 * Decode local frame tree
104 * Can read SMKTREE_DECODE_MAX_RECURSION before the first check;
105 * does not overread gb on success.
107 static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length)
109 if (length > SMKTREE_DECODE_MAX_RECURSION || length > 3 * SMKTREE_BITS) {
110 av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
111 return AVERROR_INVALIDDATA;
114 if(!get_bits1(gb)){ //Leaf
115 if(hc->current >= hc->length){
116 av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
117 return AVERROR_INVALIDDATA;
119 if (get_bits_left(gb) < 8)
120 return AVERROR_INVALIDDATA;
121 hc->bits[hc->current] = prefix;
122 hc->lengths[hc->current] = length;
123 hc->values[hc->current] = get_bits(gb, 8);
129 r = smacker_decode_tree(gb, hc, prefix, length);
132 return smacker_decode_tree(gb, hc, prefix | (1U << (length - 1)), length);
139 * Checks before the first read, can overread by 6 * SMKTREE_BITS on success.
141 static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc,
142 DBCtx *ctx, int length)
144 // Larger length can cause segmentation faults due to too deep recursion.
145 if (length > SMKTREE_DECODE_BIG_MAX_RECURSION) {
146 av_log(NULL, AV_LOG_ERROR, "Maximum bigtree recursion level exceeded.\n");
147 return AVERROR_INVALIDDATA;
150 if (hc->current >= hc->length) {
151 av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
152 return AVERROR_INVALIDDATA;
154 if (get_bits_left(gb) <= 0)
155 return AVERROR_INVALIDDATA;
156 if(!get_bits1(gb)){ //Leaf
158 i1 = ctx->v1->table ? get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3) : 0;
159 i2 = ctx->v2->table ? get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3) : 0;
160 val = ctx->recode1[i1] | (ctx->recode2[i2] << 8);
161 if(val == ctx->escapes[0]) {
162 ctx->last[0] = hc->current;
164 } else if(val == ctx->escapes[1]) {
165 ctx->last[1] = hc->current;
167 } else if(val == ctx->escapes[2]) {
168 ctx->last[2] = hc->current;
172 hc->values[hc->current++] = val;
178 r = smacker_decode_bigtree(gb, hc, ctx, length + 1);
181 hc->values[t] = SMK_NODE | r;
183 r_new = smacker_decode_bigtree(gb, hc, ctx, length + 1);
191 * Store large tree as FFmpeg's vlc codes
193 * Can read FFMAX(1 + SMKTREE_DECODE_MAX_RECURSION, 2 + 3 * 16) bits
194 * before the first check; can overread by 6 * SMKTREE_BITS + 1 on success.
196 static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int **recodes, int *last, int size)
199 HuffContext h[2] = { 0 };
200 VLC vlc[2] = { { 0 } };
205 if(size >= UINT_MAX>>4){ // (((size + 3) >> 2) + 3) << 2 must not overflow
206 av_log(smk->avctx, AV_LOG_ERROR, "size too large\n");
207 return AVERROR_INVALIDDATA;
210 for (int i = 0; i < 2; i++) {
213 h[i].bits = av_malloc(256 * sizeof(h[i].bits[0]));
214 h[i].lengths = av_malloc(256 * sizeof(h[i].lengths[0]));
215 h[i].values = av_malloc(256 * sizeof(h[i].values[0]));
216 if (!h[i].bits || !h[i].lengths || !h[i].values) {
217 err = AVERROR(ENOMEM);
220 if (!get_bits1(gb)) {
222 av_log(smk->avctx, AV_LOG_ERROR, "Skipping %s bytes tree\n",
226 err = smacker_decode_tree(gb, &h[i], 0, 0);
230 if (h[i].current > 1) {
231 err = init_vlc(&vlc[i], SMKTREE_BITS, h[i].current,
232 INIT_VLC_DEFAULT_SIZES(h[i].lengths),
233 INIT_VLC_DEFAULT_SIZES(h[i].bits),
236 av_log(smk->avctx, AV_LOG_ERROR, "Cannot build VLC table\n");
242 escapes[0] = get_bits(gb, 16);
243 escapes[1] = get_bits(gb, 16);
244 escapes[2] = get_bits(gb, 16);
246 last[0] = last[1] = last[2] = -1;
248 ctx.escapes[0] = escapes[0];
249 ctx.escapes[1] = escapes[1];
250 ctx.escapes[2] = escapes[2];
253 ctx.recode1 = h[0].values;
254 ctx.recode2 = h[1].values;
257 huff.length = (size + 3) >> 2;
259 huff.values = av_malloc_array(huff.length + 3, sizeof(huff.values[0]));
261 err = AVERROR(ENOMEM);
264 *recodes = huff.values;
266 err = smacker_decode_bigtree(gb, &huff, &ctx, 0);
270 if(ctx.last[0] == -1) ctx.last[0] = huff.current++;
271 if(ctx.last[1] == -1) ctx.last[1] = huff.current++;
272 if(ctx.last[2] == -1) ctx.last[2] = huff.current++;
276 for (int i = 0; i < 2; i++) {
277 ff_free_vlc(&vlc[i]);
279 av_free(h[i].lengths);
280 av_free(h[i].values);
286 static int decode_header_trees(SmackVContext *smk) {
288 int mmap_size, mclr_size, full_size, type_size, ret;
291 mmap_size = AV_RL32(smk->avctx->extradata);
292 mclr_size = AV_RL32(smk->avctx->extradata + 4);
293 full_size = AV_RL32(smk->avctx->extradata + 8);
294 type_size = AV_RL32(smk->avctx->extradata + 12);
296 ret = init_get_bits8(&gb, smk->avctx->extradata + 16, smk->avctx->extradata_size - 16);
300 if(!get_bits1(&gb)) {
302 av_log(smk->avctx, AV_LOG_INFO, "Skipping MMAP tree\n");
303 smk->mmap_tbl = av_malloc(sizeof(int) * 2);
305 return AVERROR(ENOMEM);
306 smk->mmap_tbl[0] = 0;
307 smk->mmap_last[0] = smk->mmap_last[1] = smk->mmap_last[2] = 1;
309 ret = smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size);
313 if(!get_bits1(&gb)) {
315 av_log(smk->avctx, AV_LOG_INFO, "Skipping MCLR tree\n");
316 smk->mclr_tbl = av_malloc(sizeof(int) * 2);
318 return AVERROR(ENOMEM);
319 smk->mclr_tbl[0] = 0;
320 smk->mclr_last[0] = smk->mclr_last[1] = smk->mclr_last[2] = 1;
322 ret = smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size);
326 if(!get_bits1(&gb)) {
328 av_log(smk->avctx, AV_LOG_INFO, "Skipping FULL tree\n");
329 smk->full_tbl = av_malloc(sizeof(int) * 2);
331 return AVERROR(ENOMEM);
332 smk->full_tbl[0] = 0;
333 smk->full_last[0] = smk->full_last[1] = smk->full_last[2] = 1;
335 ret = smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size);
339 if(!get_bits1(&gb)) {
341 av_log(smk->avctx, AV_LOG_INFO, "Skipping TYPE tree\n");
342 smk->type_tbl = av_malloc(sizeof(int) * 2);
344 return AVERROR(ENOMEM);
345 smk->type_tbl[0] = 0;
346 smk->type_last[0] = smk->type_last[1] = smk->type_last[2] = 1;
348 ret = smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size);
352 if (skip == 4 || get_bits_left(&gb) < 0)
353 return AVERROR_INVALIDDATA;
358 static av_always_inline void last_reset(int *recode, int *last) {
359 recode[last[0]] = recode[last[1]] = recode[last[2]] = 0;
362 /* Get code and update history.
363 * Checks before reading, does not overread. */
364 static av_always_inline int smk_get_code(GetBitContext *gb, int *recode, int *last) {
365 register int *table = recode;
368 while(*table & SMK_NODE) {
369 if (get_bits_left(gb) < 1)
370 return AVERROR_INVALIDDATA;
372 table += (*table) & (~SMK_NODE);
377 if(v != recode[last[0]]) {
378 recode[last[2]] = recode[last[1]];
379 recode[last[1]] = recode[last[0]];
385 static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
388 SmackVContext * const smk = avctx->priv_data;
393 int blocks, blk, bw, bh;
398 if (avpkt->size <= 769)
399 return AVERROR_INVALIDDATA;
401 if ((ret = ff_reget_buffer(avctx, smk->pic, 0)) < 0)
404 /* make the palette available on the way out */
405 pal = (uint32_t*)smk->pic->data[1];
406 bytestream2_init(&gb2, avpkt->data, avpkt->size);
407 flags = bytestream2_get_byteu(&gb2);
408 smk->pic->palette_has_changed = flags & 1;
409 smk->pic->key_frame = !!(flags & 2);
410 if (smk->pic->key_frame)
411 smk->pic->pict_type = AV_PICTURE_TYPE_I;
413 smk->pic->pict_type = AV_PICTURE_TYPE_P;
415 for(i = 0; i < 256; i++)
416 *pal++ = 0xFFU << 24 | bytestream2_get_be24u(&gb2);
418 last_reset(smk->mmap_tbl, smk->mmap_last);
419 last_reset(smk->mclr_tbl, smk->mclr_last);
420 last_reset(smk->full_tbl, smk->full_last);
421 last_reset(smk->type_tbl, smk->type_last);
422 if ((ret = init_get_bits8(&gb, avpkt->data + 769, avpkt->size - 769)) < 0)
426 bw = avctx->width >> 2;
427 bh = avctx->height >> 2;
429 stride = smk->pic->linesize[0];
430 while(blk < blocks) {
434 type = smk_get_code(&gb, smk->type_tbl, smk->type_last);
437 run = block_runs[(type >> 2) & 0x3F];
440 while(run-- && blk < blocks){
443 clr = smk_get_code(&gb, smk->mclr_tbl, smk->mclr_last);
444 map = smk_get_code(&gb, smk->mmap_tbl, smk->mmap_last);
445 out = smk->pic->data[0] + (blk / bw) * (stride * 4) + (blk % bw) * 4;
448 for(i = 0; i < 4; i++) {
449 if(map & 1) out[0] = hi; else out[0] = lo;
450 if(map & 2) out[1] = hi; else out[1] = lo;
451 if(map & 4) out[2] = hi; else out[2] = lo;
452 if(map & 8) out[3] = hi; else out[3] = lo;
461 if(avctx->codec_tag == MKTAG('S', 'M', 'K', '4')) { // In case of Smacker v4 we have three modes
462 if(get_bits1(&gb)) mode = 1;
463 else if(get_bits1(&gb)) mode = 2;
465 while(run-- && blk < blocks){
466 out = smk->pic->data[0] + (blk / bw) * (stride * 4) + (blk % bw) * 4;
469 for(i = 0; i < 4; i++) {
470 pix = smk_get_code(&gb, smk->full_tbl, smk->full_last);
472 pix = smk_get_code(&gb, smk->full_tbl, smk->full_last);
478 pix = smk_get_code(&gb, smk->full_tbl, smk->full_last);
479 out[0] = out[1] = pix & 0xFF;
480 out[2] = out[3] = pix >> 8;
482 out[0] = out[1] = pix & 0xFF;
483 out[2] = out[3] = pix >> 8;
485 pix = smk_get_code(&gb, smk->full_tbl, smk->full_last);
486 out[0] = out[1] = pix & 0xFF;
487 out[2] = out[3] = pix >> 8;
489 out[0] = out[1] = pix & 0xFF;
490 out[2] = out[3] = pix >> 8;
493 for(i = 0; i < 2; i++) {
495 pix2 = smk_get_code(&gb, smk->full_tbl, smk->full_last);
496 pix1 = smk_get_code(&gb, smk->full_tbl, smk->full_last);
510 while(run-- && blk < blocks)
515 while(run-- && blk < blocks){
517 out = smk->pic->data[0] + (blk / bw) * (stride * 4) + (blk % bw) * 4;
518 col = mode * 0x01010101U;
519 for(i = 0; i < 4; i++) {
520 *((uint32_t*)out) = col;
530 if ((ret = av_frame_ref(data, smk->pic)) < 0)
535 /* always report that the buffer was completely consumed */
540 static av_cold int decode_end(AVCodecContext *avctx)
542 SmackVContext * const smk = avctx->priv_data;
544 av_freep(&smk->mmap_tbl);
545 av_freep(&smk->mclr_tbl);
546 av_freep(&smk->full_tbl);
547 av_freep(&smk->type_tbl);
549 av_frame_free(&smk->pic);
555 static av_cold int decode_init(AVCodecContext *avctx)
557 SmackVContext * const c = avctx->priv_data;
562 avctx->pix_fmt = AV_PIX_FMT_PAL8;
564 c->pic = av_frame_alloc();
566 return AVERROR(ENOMEM);
568 /* decode huffman trees from extradata */
569 if (avctx->extradata_size <= 16){
570 av_log(avctx, AV_LOG_ERROR, "Extradata missing!\n");
571 return AVERROR(EINVAL);
574 ret = decode_header_trees(c);
583 static av_cold int smka_decode_init(AVCodecContext *avctx)
585 if (avctx->channels < 1 || avctx->channels > 2) {
586 av_log(avctx, AV_LOG_ERROR, "invalid number of channels\n");
587 return AVERROR_INVALIDDATA;
589 avctx->channel_layout = (avctx->channels==2) ? AV_CH_LAYOUT_STEREO : AV_CH_LAYOUT_MONO;
590 avctx->sample_fmt = avctx->bits_per_coded_sample == 8 ? AV_SAMPLE_FMT_U8 : AV_SAMPLE_FMT_S16;
596 * Decode Smacker audio data
598 static int smka_decode_frame(AVCodecContext *avctx, void *data,
599 int *got_frame_ptr, AVPacket *avpkt)
601 AVFrame *frame = data;
602 const uint8_t *buf = avpkt->data;
603 int buf_size = avpkt->size;
605 HuffContext h[4] = { { 0 } };
606 VLC vlc[4] = { { 0 } };
613 int pred[2] = {0, 0};
616 av_log(avctx, AV_LOG_ERROR, "packet is too small\n");
617 return AVERROR_INVALIDDATA;
620 unp_size = AV_RL32(buf);
622 if (unp_size > (1U<<24)) {
623 av_log(avctx, AV_LOG_ERROR, "packet is too big\n");
624 return AVERROR_INVALIDDATA;
627 if ((ret = init_get_bits8(&gb, buf + 4, buf_size - 4)) < 0)
631 av_log(avctx, AV_LOG_INFO, "Sound: no data\n");
635 stereo = get_bits1(&gb);
636 bits = get_bits1(&gb);
637 if (stereo ^ (avctx->channels != 1)) {
638 av_log(avctx, AV_LOG_ERROR, "channels mismatch\n");
639 return AVERROR_INVALIDDATA;
641 if (bits == (avctx->sample_fmt == AV_SAMPLE_FMT_U8)) {
642 av_log(avctx, AV_LOG_ERROR, "sample format mismatch\n");
643 return AVERROR_INVALIDDATA;
646 /* get output buffer */
647 frame->nb_samples = unp_size / (avctx->channels * (bits + 1));
648 if (unp_size % (avctx->channels * (bits + 1))) {
649 av_log(avctx, AV_LOG_ERROR,
650 "The buffer does not contain an integer number of samples\n");
651 return AVERROR_INVALIDDATA;
653 if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
655 samples = (int16_t *)frame->data[0];
656 samples8 = frame->data[0];
659 for(i = 0; i < (1 << (bits + stereo)); i++) {
662 h[i].bits = av_malloc(256 * sizeof(h[i].bits));
663 h[i].lengths = av_malloc(256 * sizeof(h[i].lengths));
664 h[i].values = av_malloc(256 * sizeof(h[i].values));
665 if (!h[i].bits || !h[i].lengths || !h[i].values) {
666 ret = AVERROR(ENOMEM);
670 if ((ret = smacker_decode_tree(&gb, &h[i], 0, 0)) < 0)
673 if(h[i].current > 1) {
674 ret = init_vlc(&vlc[i], SMKTREE_BITS, h[i].current,
675 h[i].lengths, sizeof(int), sizeof(int),
676 h[i].bits, sizeof(uint32_t), sizeof(uint32_t), INIT_VLC_LE);
678 av_log(avctx, AV_LOG_ERROR, "Cannot build VLC table\n");
683 /* this codec relies on wraparound instead of clipping audio */
684 if(bits) { //decode 16-bit data
685 for(i = stereo; i >= 0; i--)
686 pred[i] = sign_extend(av_bswap16(get_bits(&gb, 16)), 16);
687 for(i = 0; i <= stereo; i++)
688 *samples++ = pred[i];
689 for(; i < unp_size / 2; i++) {
690 if (get_bits_left(&gb) < 0) {
691 ret = AVERROR_INVALIDDATA;
696 res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
699 val = h[2].values[res];
701 res = get_vlc2(&gb, vlc[3].table, SMKTREE_BITS, 3);
704 val |= h[3].values[res] << 8;
705 pred[1] += (unsigned)sign_extend(val, 16);
706 *samples++ = pred[1];
709 res = get_vlc2(&gb, vlc[0].table, SMKTREE_BITS, 3);
712 val = h[0].values[res];
714 res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);
717 val |= h[1].values[res] << 8;
718 pred[0] += (unsigned)sign_extend(val, 16);
719 *samples++ = pred[0];
722 } else { //8-bit data
723 for(i = stereo; i >= 0; i--)
724 pred[i] = get_bits(&gb, 8);
725 for(i = 0; i <= stereo; i++)
726 *samples8++ = pred[i];
727 for(; i < unp_size; i++) {
728 if (get_bits_left(&gb) < 0) {
729 ret = AVERROR_INVALIDDATA;
734 res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);
737 pred[1] += sign_extend(h[1].values[res], 8);
738 *samples8++ = pred[1];
741 res = get_vlc2(&gb, vlc[0].table, SMKTREE_BITS, 3);
744 pred[0] += sign_extend(h[0].values[res], 8);
745 *samples8++ = pred[0];
754 for(i = 0; i < 4; i++) {
755 ff_free_vlc(&vlc[i]);
757 av_free(h[i].lengths);
758 av_free(h[i].values);
764 AVCodec ff_smacker_decoder = {
766 .long_name = NULL_IF_CONFIG_SMALL("Smacker video"),
767 .type = AVMEDIA_TYPE_VIDEO,
768 .id = AV_CODEC_ID_SMACKVIDEO,
769 .priv_data_size = sizeof(SmackVContext),
772 .decode = decode_frame,
773 .capabilities = AV_CODEC_CAP_DR1,
774 .caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
777 AVCodec ff_smackaud_decoder = {
779 .long_name = NULL_IF_CONFIG_SMALL("Smacker audio"),
780 .type = AVMEDIA_TYPE_AUDIO,
781 .id = AV_CODEC_ID_SMACKAUDIO,
782 .init = smka_decode_init,
783 .decode = smka_decode_frame,
784 .capabilities = AV_CODEC_CAP_DR1,