]> git.sesse.net Git - ffmpeg/blob - libavformat/asf.c
various security fixes and precautionary checks
[ffmpeg] / libavformat / asf.c
1 /*
2  * ASF compatible decoder.
3  * Copyright (c) 2000, 2001 Fabrice Bellard.
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the Free Software
17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
18  */
19 #include "avformat.h"
20 #include "avi.h"
21 #include "mpegaudio.h"
22 #include "asf.h"
23
24 #undef NDEBUG
25 #include <assert.h>
26
27 #define FRAME_HEADER_SIZE 17
28 // Fix Me! FRAME_HEADER_SIZE may be different. 
29
30 static const GUID index_guid = {
31     0x33000890, 0xe5b1, 0x11cf, { 0x89, 0xf4, 0x00, 0xa0, 0xc9, 0x03, 0x49, 0xcb },
32 };
33
34 /**********************************/
35 /* decoding */
36
37 //#define DEBUG
38
39 #ifdef DEBUG
40 #define PRINT_IF_GUID(g,cmp) \
41 if (!memcmp(g, &cmp, sizeof(GUID))) \
42     printf("(GUID: %s) ", #cmp)
43
44 static void print_guid(const GUID *g)
45 {
46     int i;
47     PRINT_IF_GUID(g, asf_header);
48     else PRINT_IF_GUID(g, file_header);
49     else PRINT_IF_GUID(g, stream_header);
50     else PRINT_IF_GUID(g, audio_stream);
51     else PRINT_IF_GUID(g, audio_conceal_none);
52     else PRINT_IF_GUID(g, video_stream);
53     else PRINT_IF_GUID(g, video_conceal_none);
54     else PRINT_IF_GUID(g, comment_header);
55     else PRINT_IF_GUID(g, codec_comment_header);
56     else PRINT_IF_GUID(g, codec_comment1_header);
57     else PRINT_IF_GUID(g, data_header);
58     else PRINT_IF_GUID(g, index_guid);
59     else PRINT_IF_GUID(g, head1_guid);
60     else PRINT_IF_GUID(g, head2_guid);
61     else PRINT_IF_GUID(g, my_guid);
62     else
63         printf("(GUID: unknown) ");
64     printf("0x%08x, 0x%04x, 0x%04x, {", g->v1, g->v2, g->v3);
65     for(i=0;i<8;i++)
66         printf(" 0x%02x,", g->v4[i]);
67     printf("}\n");
68 }
69 #undef PRINT_IF_GUID(g,cmp)
70 #endif
71
72 static void get_guid(ByteIOContext *s, GUID *g)
73 {
74     int i;
75
76     g->v1 = get_le32(s);
77     g->v2 = get_le16(s);
78     g->v3 = get_le16(s);
79     for(i=0;i<8;i++)
80         g->v4[i] = get_byte(s);
81 }
82
83 #if 0
84 static void get_str16(ByteIOContext *pb, char *buf, int buf_size)
85 {
86     int len, c;
87     char *q;
88
89     len = get_le16(pb);
90     q = buf;
91     while (len > 0) {
92         c = get_le16(pb);
93         if ((q - buf) < buf_size - 1)
94             *q++ = c;
95         len--;
96     }
97     *q = '\0';
98 }
99 #endif
100
101 static void get_str16_nolen(ByteIOContext *pb, int len, char *buf, int buf_size)
102 {
103     int c;
104     char *q;
105
106     q = buf;
107     while (len > 0) {
108         c = get_le16(pb);
109         if ((q - buf) < buf_size - 1)
110             *q++ = c;
111         len-=2;
112     }
113     *q = '\0';
114 }
115
116 static int asf_probe(AVProbeData *pd)
117 {
118     GUID g;
119     const unsigned char *p;
120     int i;
121
122     /* check file header */
123     if (pd->buf_size <= 32)
124         return 0;
125     p = pd->buf;
126     g.v1 = p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
127     p += 4;
128     g.v2 = p[0] | (p[1] << 8);
129     p += 2;
130     g.v3 = p[0] | (p[1] << 8);
131     p += 2;
132     for(i=0;i<8;i++)
133         g.v4[i] = *p++;
134
135     if (!memcmp(&g, &asf_header, sizeof(GUID)))
136         return AVPROBE_SCORE_MAX;
137     else
138         return 0;
139 }
140
141 static int asf_read_header(AVFormatContext *s, AVFormatParameters *ap)
142 {
143     ASFContext *asf = s->priv_data;
144     GUID g;
145     ByteIOContext *pb = &s->pb;
146     AVStream *st;
147     ASFStream *asf_st;
148     int size, i;
149     int64_t gsize;
150
151     get_guid(pb, &g);
152     if (memcmp(&g, &asf_header, sizeof(GUID)))
153         goto fail;
154     get_le64(pb);
155     get_le32(pb);
156     get_byte(pb);
157     get_byte(pb);
158     memset(&asf->asfid2avid, -1, sizeof(asf->asfid2avid));
159     for(;;) {
160         get_guid(pb, &g);
161         gsize = get_le64(pb);
162 #ifdef DEBUG
163         printf("%08Lx: ", url_ftell(pb) - 24);
164         print_guid(&g);
165         printf("  size=0x%Lx\n", gsize);
166 #endif
167         if (gsize < 24)
168             goto fail;
169         if (!memcmp(&g, &file_header, sizeof(GUID))) {
170             get_guid(pb, &asf->hdr.guid);
171             asf->hdr.file_size          = get_le64(pb);
172             asf->hdr.create_time        = get_le64(pb);
173             asf->hdr.packets_count      = get_le64(pb);
174             asf->hdr.play_time          = get_le64(pb);
175             asf->hdr.send_time          = get_le64(pb);
176             asf->hdr.preroll            = get_le32(pb);
177             asf->hdr.ignore             = get_le32(pb);
178             asf->hdr.flags              = get_le32(pb);
179             asf->hdr.min_pktsize        = get_le32(pb);
180             asf->hdr.max_pktsize        = get_le32(pb);
181             asf->hdr.max_bitrate        = get_le32(pb);
182             asf->packet_size = asf->hdr.max_pktsize;
183             asf->nb_packets = asf->hdr.packets_count;
184         } else if (!memcmp(&g, &stream_header, sizeof(GUID))) {
185             int type, total_size, type_specific_size;
186             unsigned int tag1;
187             int64_t pos1, pos2;
188
189             pos1 = url_ftell(pb);
190
191             st = av_new_stream(s, 0);
192             if (!st)
193                 goto fail;
194             av_set_pts_info(st, 32, 1, 1000); /* 32 bit pts in ms */
195             asf_st = av_mallocz(sizeof(ASFStream));
196             if (!asf_st)
197                 goto fail;
198             st->priv_data = asf_st;
199             st->start_time = asf->hdr.preroll * (int64_t)AV_TIME_BASE / 1000;
200             st->duration = asf->hdr.send_time / 
201                 (10000000 / AV_TIME_BASE) - st->start_time;
202             get_guid(pb, &g);
203             if (!memcmp(&g, &audio_stream, sizeof(GUID))) {
204                 type = CODEC_TYPE_AUDIO;
205             } else if (!memcmp(&g, &video_stream, sizeof(GUID))) {
206                 type = CODEC_TYPE_VIDEO;
207             } else {
208                 goto fail;
209             }
210             get_guid(pb, &g);
211             total_size = get_le64(pb);
212             type_specific_size = get_le32(pb);
213             get_le32(pb);
214             st->id = get_le16(pb) & 0x7f; /* stream id */
215             // mapping of asf ID to AV stream ID;
216             asf->asfid2avid[st->id] = s->nb_streams - 1;
217
218             get_le32(pb);
219             st->codec.codec_type = type;
220             /* 1 fps default (XXX: put 0 fps instead) */
221             st->codec.frame_rate = 1000; 
222             st->codec.frame_rate_base = 1;
223             if (type == CODEC_TYPE_AUDIO) {
224                 get_wav_header(pb, &st->codec, type_specific_size);
225                 st->need_parsing = 1;
226                 /* We have to init the frame size at some point .... */
227                 pos2 = url_ftell(pb);
228                 if (gsize > (pos2 + 8 - pos1 + 24)) {
229                     asf_st->ds_span = get_byte(pb);
230                     asf_st->ds_packet_size = get_le16(pb);
231                     asf_st->ds_chunk_size = get_le16(pb);
232                     asf_st->ds_data_size = get_le16(pb);
233                     asf_st->ds_silence_data = get_byte(pb);
234                 }
235                 //printf("Descrambling: ps:%d cs:%d ds:%d s:%d  sd:%d\n",
236                 //       asf_st->ds_packet_size, asf_st->ds_chunk_size,
237                 //       asf_st->ds_data_size, asf_st->ds_span, asf_st->ds_silence_data);
238                 if (asf_st->ds_span > 1) {
239                     if (!asf_st->ds_chunk_size
240                         || (asf_st->ds_packet_size/asf_st->ds_chunk_size <= 1))
241                         asf_st->ds_span = 0; // disable descrambling
242                 }
243                 switch (st->codec.codec_id) {
244                 case CODEC_ID_MP3:
245                     st->codec.frame_size = MPA_FRAME_SIZE;
246                     break;
247                 case CODEC_ID_PCM_S16LE:
248                 case CODEC_ID_PCM_S16BE:
249                 case CODEC_ID_PCM_U16LE:
250                 case CODEC_ID_PCM_U16BE:
251                 case CODEC_ID_PCM_S8:
252                 case CODEC_ID_PCM_U8:
253                 case CODEC_ID_PCM_ALAW:
254                 case CODEC_ID_PCM_MULAW:
255                     st->codec.frame_size = 1;
256                     break;
257                 default:
258                     /* This is probably wrong, but it prevents a crash later */
259                     st->codec.frame_size = 1;
260                     break;
261                 }
262             } else {
263                 get_le32(pb);
264                 get_le32(pb);
265                 get_byte(pb);
266                 size = get_le16(pb); /* size */
267                 get_le32(pb); /* size */
268                 st->codec.width = get_le32(pb);
269                 st->codec.height = get_le32(pb);
270                 /* not available for asf */
271                 get_le16(pb); /* panes */
272                 st->codec.bits_per_sample = get_le16(pb); /* depth */
273                 tag1 = get_le32(pb);
274                 url_fskip(pb, 20);
275                 if (size > 40) {
276                     st->codec.extradata_size = size - 40;
277                     st->codec.extradata = av_mallocz(st->codec.extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
278                     get_buffer(pb, st->codec.extradata, st->codec.extradata_size);
279                 }
280
281         /* Extract palette from extradata if bpp <= 8 */
282         /* This code assumes that extradata contains only palette */
283         /* This is true for all paletted codecs implemented in ffmpeg */
284         if (st->codec.extradata_size && (st->codec.bits_per_sample <= 8)) {
285             st->codec.palctrl = av_mallocz(sizeof(AVPaletteControl));
286 #ifdef WORDS_BIGENDIAN
287             for (i = 0; i < FFMIN(st->codec.extradata_size, AVPALETTE_SIZE)/4; i++)
288                 st->codec.palctrl->palette[i] = bswap_32(((uint32_t*)st->codec.extradata)[i]);
289 #else
290             memcpy(st->codec.palctrl->palette, st->codec.extradata,
291                    FFMIN(st->codec.extradata_size, AVPALETTE_SIZE));
292 #endif
293             st->codec.palctrl->palette_changed = 1;
294         }
295
296                 st->codec.codec_tag = tag1;
297                 st->codec.codec_id = codec_get_id(codec_bmp_tags, tag1);
298                 if(tag1 == MKTAG('D', 'V', 'R', ' '))
299                     st->need_parsing = 1;
300             }
301             pos2 = url_ftell(pb);
302             url_fskip(pb, gsize - (pos2 - pos1 + 24));
303         } else if (!memcmp(&g, &data_header, sizeof(GUID))) {
304             break;
305         } else if (!memcmp(&g, &comment_header, sizeof(GUID))) {
306             int len1, len2, len3, len4, len5;
307
308             len1 = get_le16(pb);
309             len2 = get_le16(pb);
310             len3 = get_le16(pb);
311             len4 = get_le16(pb);
312             len5 = get_le16(pb);
313             get_str16_nolen(pb, len1, s->title, sizeof(s->title));
314             get_str16_nolen(pb, len2, s->author, sizeof(s->author));
315             get_str16_nolen(pb, len3, s->copyright, sizeof(s->copyright));
316             get_str16_nolen(pb, len4, s->comment, sizeof(s->comment));
317             url_fskip(pb, len5);
318        } else if (!memcmp(&g, &extended_content_header, sizeof(GUID))) {
319                 int desc_count, i;
320
321                 desc_count = get_le16(pb);
322                 for(i=0;i<desc_count;i++)
323                 {
324                         int name_len,value_type,value_len,value_num = 0;
325                         char *name, *value;
326
327                         name_len = get_le16(pb);
328                         name = (char *)av_mallocz(name_len);
329                         get_str16_nolen(pb, name_len, name, name_len);
330                         value_type = get_le16(pb);
331                         value_len = get_le16(pb);
332                         if ((value_type == 0) || (value_type == 1)) // unicode or byte
333                         {
334                                 value = (char *)av_mallocz(value_len);
335                                 get_str16_nolen(pb, value_len, value, value_len);
336                                 if (strcmp(name,"WM/AlbumTitle")==0) { pstrcpy(s->album, sizeof(s->album), value); }
337                                 av_free(value);
338                         }
339                         if ((value_type >= 2) || (value_type <= 5)) // boolean or DWORD or QWORD or WORD
340                         {
341                                 if (value_type==2) value_num = get_le32(pb);
342                                 if (value_type==3) value_num = get_le32(pb);
343                                 if (value_type==4) value_num = get_le64(pb);
344                                 if (value_type==5) value_num = get_le16(pb);
345                                 if (strcmp(name,"WM/Track")==0) s->track = value_num + 1;
346                                 if (strcmp(name,"WM/TrackNumber")==0) s->track = value_num;
347                         }
348                         av_free(name);
349                 }
350 #if 0
351         } else if (!memcmp(&g, &head1_guid, sizeof(GUID))) {
352             int v1, v2;
353             get_guid(pb, &g);
354             v1 = get_le32(pb);
355             v2 = get_le16(pb);
356         } else if (!memcmp(&g, &codec_comment_header, sizeof(GUID))) {
357             int len, v1, n, num;
358             char str[256], *q;
359             char tag[16];
360
361             get_guid(pb, &g);
362             print_guid(&g);
363
364             n = get_le32(pb);
365             for(i=0;i<n;i++) {
366                 num = get_le16(pb); /* stream number */
367                 get_str16(pb, str, sizeof(str));
368                 get_str16(pb, str, sizeof(str));
369                 len = get_le16(pb);
370                 q = tag;
371                 while (len > 0) {
372                     v1 = get_byte(pb);
373                     if ((q - tag) < sizeof(tag) - 1)
374                         *q++ = v1;
375                     len--;
376                 }
377                 *q = '\0';
378             }
379 #endif
380         } else if (url_feof(pb)) {
381             goto fail;
382         } else {
383             url_fseek(pb, gsize - 24, SEEK_CUR);
384         }
385     }
386     get_guid(pb, &g);
387     get_le64(pb);
388     get_byte(pb);
389     get_byte(pb);
390     if (url_feof(pb))
391         goto fail;
392     asf->data_offset = url_ftell(pb);
393     asf->packet_size_left = 0;
394
395     return 0;
396
397  fail:
398      for(i=0;i<s->nb_streams;i++) {
399         AVStream *st = s->streams[i];
400         if (st) {
401             av_free(st->priv_data);
402             av_free(st->codec.extradata);
403         }
404         av_free(st);
405     }
406     return -1;
407 }
408
409 #define DO_2BITS(bits, var, defval) \
410     switch (bits & 3) \
411     { \
412     case 3: var = get_le32(pb); rsize += 4; break; \
413     case 2: var = get_le16(pb); rsize += 2; break; \
414     case 1: var = get_byte(pb); rsize++; break; \
415     default: var = defval; break; \
416     }
417
418 static int asf_get_packet(AVFormatContext *s)
419 {
420     ASFContext *asf = s->priv_data;
421     ByteIOContext *pb = &s->pb;
422     uint32_t packet_length, padsize;
423     int rsize = 9;
424     int c;
425     
426     if((url_ftell(&s->pb) - s->data_offset) % asf->packet_size)
427         return -1;
428     assert((url_ftell(&s->pb) - s->data_offset) % asf->packet_size == 0);
429     
430     c = get_byte(pb);
431     if (c != 0x82) {
432         if (!url_feof(pb))
433             av_log(s, AV_LOG_ERROR, "ff asf bad header %x  at:%lld\n", c, url_ftell(pb));
434     }
435     if ((c & 0x0f) == 2) { // always true for now
436         if (get_le16(pb) != 0) {
437             if (!url_feof(pb))
438                 av_log(s, AV_LOG_ERROR, "ff asf bad non zero\n");
439             return AVERROR_IO;
440         }
441         rsize+=2;
442 /*    }else{
443         if (!url_feof(pb))
444             printf("ff asf bad header %x  at:%lld\n", c, url_ftell(pb));
445         return AVERROR_IO;*/
446     }
447
448     asf->packet_flags = get_byte(pb);
449     asf->packet_property = get_byte(pb);
450
451     DO_2BITS(asf->packet_flags >> 5, packet_length, asf->packet_size);
452     DO_2BITS(asf->packet_flags >> 1, padsize, 0); // sequence ignored
453     DO_2BITS(asf->packet_flags >> 3, padsize, 0); // padding length
454
455     asf->packet_timestamp = get_le32(pb);
456     get_le16(pb); /* duration */
457     // rsize has at least 11 bytes which have to be present
458
459     if (asf->packet_flags & 0x01) {
460         asf->packet_segsizetype = get_byte(pb); rsize++;
461         asf->packet_segments = asf->packet_segsizetype & 0x3f;
462     } else {
463         asf->packet_segments = 1;
464         asf->packet_segsizetype = 0x80;
465     }
466     asf->packet_size_left = packet_length - padsize - rsize;
467     if (packet_length < asf->hdr.min_pktsize)
468         padsize += asf->hdr.min_pktsize - packet_length;
469     asf->packet_padsize = padsize;
470 #ifdef DEBUG
471     printf("packet: size=%d padsize=%d  left=%d\n", asf->packet_size, asf->packet_padsize, asf->packet_size_left);
472 #endif
473     return 0;
474 }
475
476 static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
477 {
478     ASFContext *asf = s->priv_data;
479     ASFStream *asf_st = 0;
480     ByteIOContext *pb = &s->pb;
481     //static int pc = 0;
482     for (;;) {
483         int rsize = 0;
484         if (asf->packet_size_left < FRAME_HEADER_SIZE
485             || asf->packet_segments < 1) {
486             //asf->packet_size_left <= asf->packet_padsize) {
487             int ret = asf->packet_size_left + asf->packet_padsize;
488             //printf("PacketLeftSize:%d  Pad:%d Pos:%Ld\n", asf->packet_size_left, asf->packet_padsize, url_ftell(pb));
489             /* fail safe */
490             url_fskip(pb, ret);
491             asf->packet_pos= url_ftell(&s->pb);
492             ret = asf_get_packet(s);
493             //printf("READ ASF PACKET  %d   r:%d   c:%d\n", ret, asf->packet_size_left, pc++);
494             if (ret < 0 || url_feof(pb))
495                 return AVERROR_IO;
496             asf->packet_time_start = 0;
497             continue;
498         }
499         if (asf->packet_time_start == 0) {
500             /* read frame header */
501             int num = get_byte(pb);
502             asf->packet_segments--;
503             rsize++;
504             asf->packet_key_frame = (num & 0x80) >> 7;
505             asf->stream_index = asf->asfid2avid[num & 0x7f];
506             // sequence should be ignored!
507             DO_2BITS(asf->packet_property >> 4, asf->packet_seq, 0);
508             DO_2BITS(asf->packet_property >> 2, asf->packet_frag_offset, 0);
509             DO_2BITS(asf->packet_property, asf->packet_replic_size, 0);
510 //printf("key:%d stream:%d seq:%d offset:%d replic_size:%d\n", asf->packet_key_frame, asf->stream_index, asf->packet_seq, //asf->packet_frag_offset, asf->packet_replic_size);
511             if (asf->packet_replic_size > 1) {
512                 assert(asf->packet_replic_size >= 8);
513                 // it should be always at least 8 bytes - FIXME validate
514                 asf->packet_obj_size = get_le32(pb);
515                 asf->packet_frag_timestamp = get_le32(pb); // timestamp
516                 if (asf->packet_replic_size > 8)
517                     url_fskip(pb, asf->packet_replic_size - 8);
518                 rsize += asf->packet_replic_size; // FIXME - check validity
519             } else if (asf->packet_replic_size==1){
520                 // multipacket - frag_offset is begining timestamp
521                 asf->packet_time_start = asf->packet_frag_offset;
522                 asf->packet_frag_offset = 0;
523                 asf->packet_frag_timestamp = asf->packet_timestamp;
524
525                 asf->packet_time_delta = get_byte(pb);
526                 rsize++;
527             }else{
528                 assert(asf->packet_replic_size==0);
529             }
530             if (asf->packet_flags & 0x01) {
531                 DO_2BITS(asf->packet_segsizetype >> 6, asf->packet_frag_size, 0); // 0 is illegal
532 #undef DO_2BITS
533                 //printf("Fragsize %d\n", asf->packet_frag_size);
534             } else {
535                 asf->packet_frag_size = asf->packet_size_left - rsize;
536                 //printf("Using rest  %d %d %d\n", asf->packet_frag_size, asf->packet_size_left, rsize);
537             }
538             if (asf->packet_replic_size == 1) {
539                 asf->packet_multi_size = asf->packet_frag_size;
540                 if (asf->packet_multi_size > asf->packet_size_left) {
541                     asf->packet_segments = 0;
542                     continue;
543                 }
544             }
545             asf->packet_size_left -= rsize;
546             //printf("___objsize____  %d   %d    rs:%d\n", asf->packet_obj_size, asf->packet_frag_offset, rsize);
547
548             if (asf->stream_index < 0) {
549                 asf->packet_time_start = 0;
550                 /* unhandled packet (should not happen) */
551                 url_fskip(pb, asf->packet_frag_size);
552                 asf->packet_size_left -= asf->packet_frag_size;
553                 av_log(s, AV_LOG_ERROR, "ff asf skip %d  %d\n", asf->packet_frag_size, num & 0x7f);
554                 continue;
555             }
556             asf->asf_st = s->streams[asf->stream_index]->priv_data;
557         }
558         asf_st = asf->asf_st;
559
560         if ((asf->packet_frag_offset != asf_st->frag_offset
561              || (asf->packet_frag_offset
562                  && asf->packet_seq != asf_st->seq)) // seq should be ignored
563            ) {
564             /* cannot continue current packet: free it */
565             // FIXME better check if packet was already allocated
566             av_log(s, AV_LOG_INFO, "ff asf parser skips: %d - %d     o:%d - %d    %d %d   fl:%d\n",
567                    asf_st->pkt.size,
568                    asf->packet_obj_size,
569                    asf->packet_frag_offset, asf_st->frag_offset,
570                    asf->packet_seq, asf_st->seq, asf->packet_frag_size);
571             if (asf_st->pkt.size)
572                 av_free_packet(&asf_st->pkt);
573             asf_st->frag_offset = 0;
574             if (asf->packet_frag_offset != 0) {
575                 url_fskip(pb, asf->packet_frag_size);
576                 av_log(s, AV_LOG_INFO, "ff asf parser skiping %db\n", asf->packet_frag_size);
577                 asf->packet_size_left -= asf->packet_frag_size;
578                 continue;
579             }
580         }
581         if (asf->packet_replic_size == 1) {
582             // frag_offset is here used as the begining timestamp
583             asf->packet_frag_timestamp = asf->packet_time_start;
584             asf->packet_time_start += asf->packet_time_delta;
585             asf->packet_obj_size = asf->packet_frag_size = get_byte(pb);
586             asf->packet_size_left--;
587             asf->packet_multi_size--;
588             if (asf->packet_multi_size < asf->packet_obj_size)
589             {
590                 asf->packet_time_start = 0;
591                 url_fskip(pb, asf->packet_multi_size);
592                 asf->packet_size_left -= asf->packet_multi_size;
593                 continue;
594             }
595             asf->packet_multi_size -= asf->packet_obj_size;
596             //printf("COMPRESS size  %d  %d  %d   ms:%d\n", asf->packet_obj_size, asf->packet_frag_timestamp, asf->packet_size_left, asf->packet_multi_size);
597         }
598         if (asf_st->frag_offset == 0) {
599             /* new packet */
600             av_new_packet(&asf_st->pkt, asf->packet_obj_size);
601             asf_st->seq = asf->packet_seq;
602             asf_st->pkt.pts = asf->packet_frag_timestamp;
603             asf_st->pkt.stream_index = asf->stream_index;
604             asf_st->packet_pos= asf->packet_pos;            
605 //printf("new packet: stream:%d key:%d packet_key:%d audio:%d size:%d\n", 
606 //asf->stream_index, asf->packet_key_frame, asf_st->pkt.flags & PKT_FLAG_KEY,
607 //s->streams[asf->stream_index]->codec.codec_type == CODEC_TYPE_AUDIO, asf->packet_obj_size);
608             if (s->streams[asf->stream_index]->codec.codec_type == CODEC_TYPE_AUDIO) 
609                 asf->packet_key_frame = 1;
610             if (asf->packet_key_frame)
611                 asf_st->pkt.flags |= PKT_FLAG_KEY;
612         }
613
614         /* read data */
615         //printf("READ PACKET s:%d  os:%d  o:%d,%d  l:%d   DATA:%p\n",
616         //       asf->packet_size, asf_st->pkt.size, asf->packet_frag_offset,
617         //       asf_st->frag_offset, asf->packet_frag_size, asf_st->pkt.data);
618         asf->packet_size_left -= asf->packet_frag_size;
619         if (asf->packet_size_left < 0)
620             continue;
621         get_buffer(pb, asf_st->pkt.data + asf->packet_frag_offset,
622                    asf->packet_frag_size);
623         asf_st->frag_offset += asf->packet_frag_size;
624         /* test if whole packet is read */
625         if (asf_st->frag_offset == asf_st->pkt.size) {
626             /* return packet */
627             if (asf_st->ds_span > 1) {
628                 /* packet descrambling */
629                 char* newdata = av_malloc(asf_st->pkt.size);
630                 if (newdata) {
631                     int offset = 0;
632                     while (offset < asf_st->pkt.size) {
633                         int off = offset / asf_st->ds_chunk_size;
634                         int row = off / asf_st->ds_span;
635                         int col = off % asf_st->ds_span;
636                         int idx = row + col * asf_st->ds_packet_size / asf_st->ds_chunk_size;
637                         //printf("off:%d  row:%d  col:%d  idx:%d\n", off, row, col, idx);
638                         memcpy(newdata + offset,
639                                asf_st->pkt.data + idx * asf_st->ds_chunk_size,
640                                asf_st->ds_chunk_size);
641                         offset += asf_st->ds_chunk_size;
642                     }
643                     av_free(asf_st->pkt.data);
644                     asf_st->pkt.data = newdata;
645                 }
646             }
647             asf_st->frag_offset = 0;
648             memcpy(pkt, &asf_st->pkt, sizeof(AVPacket));
649             //printf("packet %d %d\n", asf_st->pkt.size, asf->packet_frag_size);
650             asf_st->pkt.size = 0;
651             asf_st->pkt.data = 0;
652             break; // packet completed
653         }
654     }
655     return 0;
656 }
657
658 static int asf_read_close(AVFormatContext *s)
659 {
660     int i;
661
662     for(i=0;i<s->nb_streams;i++) {
663         AVStream *st = s->streams[i];
664         av_free(st->priv_data);
665         av_free(st->codec.extradata);
666     av_free(st->codec.palctrl);
667     }
668     return 0;
669 }
670
671 // Added to support seeking after packets have been read
672 // If information is not reset, read_packet fails due to
673 // leftover information from previous reads
674 static void asf_reset_header(AVFormatContext *s)
675 {
676     ASFContext *asf = s->priv_data;
677     ASFStream *asf_st;
678     int i;
679
680     asf->packet_nb_frames = 0;
681     asf->packet_timestamp_start = -1;
682     asf->packet_timestamp_end = -1;
683     asf->packet_size_left = 0;
684     asf->packet_segments = 0;
685     asf->packet_flags = 0;
686     asf->packet_property = 0;
687     asf->packet_timestamp = 0;
688     asf->packet_segsizetype = 0;
689     asf->packet_segments = 0;
690     asf->packet_seq = 0;
691     asf->packet_replic_size = 0;
692     asf->packet_key_frame = 0;
693     asf->packet_padsize = 0;
694     asf->packet_frag_offset = 0;
695     asf->packet_frag_size = 0;
696     asf->packet_frag_timestamp = 0;
697     asf->packet_multi_size = 0;
698     asf->packet_obj_size = 0;
699     asf->packet_time_delta = 0;
700     asf->packet_time_start = 0;
701     
702     for(i=0; i<s->nb_streams; i++){
703         asf_st= s->streams[i]->priv_data;
704         av_free_packet(&asf_st->pkt);
705         asf_st->frag_offset=0;
706         asf_st->seq=0;
707     }
708     asf->asf_st= NULL;
709 }
710
711 static int64_t asf_read_pts(AVFormatContext *s, int stream_index, int64_t *ppos, int64_t pos_limit)
712 {
713     ASFContext *asf = s->priv_data;
714     AVPacket pkt1, *pkt = &pkt1;
715     ASFStream *asf_st;
716     int64_t pts;
717     int64_t pos= *ppos;
718     int i;
719     int64_t start_pos[s->nb_streams];
720     
721     for(i=0; i<s->nb_streams; i++){
722         start_pos[i]= pos;
723     }
724     
725     pos= (pos+asf->packet_size-1-s->data_offset)/asf->packet_size*asf->packet_size+ s->data_offset;
726     *ppos= pos;
727     url_fseek(&s->pb, pos, SEEK_SET);
728     
729 //printf("asf_read_pts\n");
730     asf_reset_header(s);
731     for(;;){
732         if (av_read_frame(s, pkt) < 0){
733             av_log(s, AV_LOG_INFO, "seek failed\n");
734             return AV_NOPTS_VALUE;
735         }
736         
737         pts= pkt->pts * 1000 / AV_TIME_BASE;
738
739         av_free_packet(pkt);
740         if(pkt->flags&PKT_FLAG_KEY){
741             i= pkt->stream_index;
742
743             asf_st= s->streams[i]->priv_data;
744
745             assert((asf_st->packet_pos - s->data_offset) % asf->packet_size == 0);
746             pos= asf_st->packet_pos;
747
748             av_add_index_entry(s->streams[i], pos, pts, pos - start_pos[i] + 1, AVINDEX_KEYFRAME);
749             start_pos[i]= asf_st->packet_pos + 1;
750             
751             if(pkt->stream_index == stream_index)
752                break;
753         }
754     }
755
756     *ppos= pos;
757 //printf("found keyframe at %Ld stream %d stamp:%Ld\n", *ppos, stream_index, pts);
758
759     return pts;
760 }
761
762 static int asf_read_seek(AVFormatContext *s, int stream_index, int64_t pts, int flags)
763 {
764     ASFContext *asf = s->priv_data;
765     
766     if (asf->packet_size <= 0)
767         return -1;
768
769     if(av_seek_frame_binary(s, stream_index, pts, flags)<0)
770         return -1;
771
772     asf_reset_header(s);
773     return 0;
774 }
775
776 static AVInputFormat asf_iformat = {
777     "asf",
778     "asf format",
779     sizeof(ASFContext),
780     asf_probe,
781     asf_read_header,
782     asf_read_packet,
783     asf_read_close,
784     asf_read_seek,
785     asf_read_pts,
786 };
787
788 #ifdef CONFIG_ENCODERS
789     extern AVOutputFormat asf_oformat;
790     extern AVOutputFormat asf_stream_oformat;
791 #endif //CONFIG_ENCODERS
792
793 int asf_init(void)
794 {
795     av_register_input_format(&asf_iformat);
796 #ifdef CONFIG_ENCODERS
797     av_register_output_format(&asf_oformat);
798     av_register_output_format(&asf_stream_oformat);
799 #endif //CONFIG_ENCODERS
800     return 0;
801 }