pthread: Fix crash due to fctx->delaying not being cleared.

[ffmpeg] / libavformat / latmenc.c

diff --git a/libavformat/latmenc.c b/libavformat/latmenc.c
index c71f78b78a62f9a32a862a350ea9d8eed6d25578..914c63237dc8cdfc00351ca98eab4afbba4a1c04 100644 (file)
--- a/libavformat/latmenc.c
+++ b/libavformat/latmenc.c
@@ -27,6 +27,8 @@
 #include "avformat.h"
 #include "rawenc.h"
 
+#define MAX_EXTRADATA_SIZE 1024
+
 typedef struct {
     AVClass *av_class;
     int off;
@@ -51,15 +53,21 @@ static const AVClass latm_muxer_class = {
 
 static int latm_decode_extradata(LATMContext *ctx, uint8_t *buf, int size)
 {
-    GetBitContext gb;
     MPEG4AudioConfig m4ac;
 
-    init_get_bits(&gb, buf, size * 8);
+    if (size > MAX_EXTRADATA_SIZE) {
+        av_log(ctx, AV_LOG_ERROR, "Extradata is larger than currently supported.\n");
+        return AVERROR_INVALIDDATA;
+    }
     ctx->off = avpriv_mpeg4audio_get_config(&m4ac, buf, size * 8, 1);
     if (ctx->off < 0)
         return ctx->off;
-    skip_bits_long(&gb, ctx->off);
 
+    if (ctx->object_type == AOT_ALS && (ctx->off & 7)) {
+        // as long as avpriv_mpeg4audio_get_config works correctly this is impossible
+        av_log(ctx, AV_LOG_ERROR, "BUG: ALS offset is not byte-aligned\n");
+        return AVERROR_INVALIDDATA;
+    }
     /* FIXME: are any formats not allowed in LATM? */
 
     if (m4ac.object_type > AOT_SBR && m4ac.object_type != AOT_ALS) {
@@ -87,19 +95,16 @@ static int latm_write_header(AVFormatContext *s)
     return 0;
 }
 
-static int latm_write_frame_header(AVFormatContext *s, PutBitContext *bs)
+static void latm_write_frame_header(AVFormatContext *s, PutBitContext *bs)
 {
     LATMContext *ctx = s->priv_data;
     AVCodecContext *avctx = s->streams[0]->codec;
-    GetBitContext gb;
     int header_size;
 
     /* AudioMuxElement */
     put_bits(bs, 1, !!ctx->counter);
 
     if (!ctx->counter) {
-        init_get_bits(&gb, avctx->extradata, avctx->extradata_size * 8);
-
         /* StreamMuxConfig */
         put_bits(bs, 1, 0); /* audioMuxVersion */
         put_bits(bs, 1, 1); /* allStreamsSameTimeFraming */
@@ -109,12 +114,17 @@ static int latm_write_frame_header(AVFormatContext *s, PutBitContext *bs)
 
         /* AudioSpecificConfig */
         if (ctx->object_type == AOT_ALS) {
-            header_size = avctx->extradata_size-(ctx->off + 7) >> 3;
-            avpriv_copy_bits(bs, &avctx->extradata[ctx->off], header_size);
+            header_size = avctx->extradata_size-(ctx->off >> 3);
+            avpriv_copy_bits(bs, &avctx->extradata[ctx->off >> 3], header_size);
         } else {
+            // + 3 assumes not scalable and dependsOnCoreCoder == 0,
+            // see decode_ga_specific_config in libavcodec/aacdec.c
             avpriv_copy_bits(bs, avctx->extradata, ctx->off + 3);
 
             if (!ctx->channel_conf) {
+                GetBitContext gb;
+                init_get_bits(&gb, avctx->extradata, avctx->extradata_size * 8);
+                skip_bits_long(&gb, ctx->off + 3);
                 avpriv_copy_pce_data(bs, &gb);
             }
         }
@@ -128,8 +138,6 @@ static int latm_write_frame_header(AVFormatContext *s, PutBitContext *bs)
 
     ctx->counter++;
     ctx->counter %= ctx->mod;
-
-    return 0;
 }
 
 static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
@@ -138,7 +146,7 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
     PutBitContext bs;
     int i, len;
     uint8_t loas_header[] = "\x56\xe0\x00";
-    uint8_t *buf;
+    uint8_t *buf = NULL;
 
     if (s->streams[0]->codec->codec_id == CODEC_ID_AAC_LATM)
         return ff_raw_write_packet(s, pkt);
@@ -147,12 +155,14 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
         av_log(s, AV_LOG_ERROR, "ADTS header detected - ADTS will not be incorrectly muxed into LATM\n");
         return AVERROR_INVALIDDATA;
     }
+    if (pkt->size > 0x1fff)
+        goto too_large;
 
-    buf = av_malloc(pkt->size+1024);
+    buf = av_malloc(pkt->size+1024+MAX_EXTRADATA_SIZE);
     if (!buf)
         return AVERROR(ENOMEM);
 
-    init_put_bits(&bs, buf, pkt->size+1024);
+    init_put_bits(&bs, buf, pkt->size+1024+MAX_EXTRADATA_SIZE);
 
     latm_write_frame_header(s, &bs);
 
@@ -165,14 +175,28 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
     /* The LATM payload is written unaligned */
 
     /* PayloadMux() */
-    for (i = 0; i < pkt->size; i++)
-        put_bits(&bs, 8, pkt->data[i]);
+    if (pkt->size && (pkt->data[0] & 0xe1) == 0x81) {
+        // Convert byte-aligned DSE to non-aligned.
+        // Due to the input format encoding we know that
+        // it is naturally byte-aligned in the input stream,
+        // so there are no padding bits to account for.
+        // To avoid having to add padding bits and rearrange
+        // the whole stream we just remove the byte-align flag.
+        // This allows us to remux our FATE AAC samples into latm
+        // files that are still playable with minimal effort.
+        put_bits(&bs, 8, pkt->data[0] & 0xfe);
+        avpriv_copy_bits(&bs, pkt->data + 1, 8*pkt->size - 8);
+    } else
+        avpriv_copy_bits(&bs, pkt->data, 8*pkt->size);
 
     avpriv_align_put_bits(&bs);
     flush_put_bits(&bs);
 
     len = put_bits_count(&bs) >> 3;
 
+    if (len > 0x1fff)
+        goto too_large;
+
     loas_header[1] |= (len >> 8) & 0x1f;
     loas_header[2] |= len & 0xff;
 
@@ -182,6 +206,11 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
     av_free(buf);
 
     return 0;
+
+too_large:
+    av_log(s, AV_LOG_ERROR, "LATM packet size larger than maximum size 0x1fff\n");
+    av_free(buf);
+    return AVERROR_INVALIDDATA;
 }
 
 AVOutputFormat ff_latm_muxer = {