Refuse to mux tta into matroska, the output file is broken.

[ffmpeg] / libavformat / rtpdec_mpeg4.c

diff --git a/libavformat/rtpdec_mpeg4.c b/libavformat/rtpdec_mpeg4.c
index a3f60d348d8d9dfd2476f5ae01f5506caa2ca006..3f1f244b83dbf6cc0e418a6333974620abaf2ca7 100644 (file)
--- a/libavformat/rtpdec_mpeg4.c
+++ b/libavformat/rtpdec_mpeg4.c
@@ -57,6 +57,9 @@ struct PayloadContext {
     int nb_au_headers;
     int au_headers_length_bytes;
     int cur_au_index;
+
+    uint8_t buf[RTP_MAX_PACKET_LENGTH];
+    int buf_pos, buf_size;
 };
 
 typedef struct {
@@ -109,11 +112,14 @@ static int parse_fmtp_config(AVCodecContext *codec, char *value)
     return 0;
 }
 
-static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf)
+static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf, int len)
 {
     int au_headers_length, au_header_size, i;
     GetBitContext getbitcontext;
 
+    if (len < 2)
+        return AVERROR_INVALIDDATA;
+
     /* decode the first 2 bytes where the AUHeader sections are stored
        length in bits */
     au_headers_length = AV_RB16(buf);
@@ -125,6 +131,10 @@ static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf)
 
     /* skip AU headers length section (2 bytes) */
     buf += 2;
+    len -= 2;
+
+    if (len < data->au_headers_length_bytes)
+        return AVERROR_INVALIDDATA;
 
     init_get_bits(&getbitcontext, buf, data->au_headers_length_bytes * 8);
 
@@ -137,21 +147,16 @@ static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf)
     if (!data->au_headers || data->au_headers_allocated < data->nb_au_headers) {
         av_free(data->au_headers);
         data->au_headers = av_malloc(sizeof(struct AUHeaders) * data->nb_au_headers);
+        if (!data->au_headers)
+            return AVERROR(ENOMEM);
         data->au_headers_allocated = data->nb_au_headers;
     }
 
-    /* XXX: We handle multiple AU Section as only one (need to fix this for interleaving)
-       In my test, the FAAD decoder does not behave correctly when sending each AU one by one
-       but does when sending the whole as one big packet...  */
-    data->au_headers[0].size = 0;
-    data->au_headers[0].index = 0;
     for (i = 0; i < data->nb_au_headers; ++i) {
-        data->au_headers[0].size += get_bits_long(&getbitcontext, data->sizelength);
-        data->au_headers[0].index = get_bits_long(&getbitcontext, data->indexlength);
+        data->au_headers[i].size  = get_bits_long(&getbitcontext, data->sizelength);
+        data->au_headers[i].index = get_bits_long(&getbitcontext, data->indexlength);
     }
 
-    data->nb_au_headers = 1;
-
     return 0;
 }
 
@@ -162,18 +167,45 @@ static int aac_parse_packet(AVFormatContext *ctx, PayloadContext *data,
                             const uint8_t *buf, int len, uint16_t seq,
                             int flags)
 {
-    if (rtp_parse_mp4_au(data, buf))
+    int ret;
+
+    if (!buf) {
+        if (data->cur_au_index > data->nb_au_headers)
+            return AVERROR_INVALIDDATA;
+        if (data->buf_size - data->buf_pos < data->au_headers[data->cur_au_index].size)
+            return AVERROR_INVALIDDATA;
+        if ((ret = av_new_packet(pkt, data->au_headers[data->cur_au_index].size)) < 0)
+            return ret;
+        memcpy(pkt->data, &data->buf[data->buf_pos], data->au_headers[data->cur_au_index].size);
+        data->buf_pos += data->au_headers[data->cur_au_index].size;
+        pkt->stream_index = st->index;
+        data->cur_au_index++;
+        return data->cur_au_index < data->nb_au_headers;
+    }
+
+    if (rtp_parse_mp4_au(data, buf, len))
         return -1;
 
     buf += data->au_headers_length_bytes + 2;
     len -= data->au_headers_length_bytes + 2;
 
-    /* XXX: Fixme we only handle the case where rtp_parse_mp4_au define
-                    one au_header */
-    av_new_packet(pkt, data->au_headers[0].size);
+    if (len < data->au_headers[0].size)
+        return AVERROR_INVALIDDATA;
+    if ((ret = av_new_packet(pkt, data->au_headers[0].size)) < 0)
+        return ret;
     memcpy(pkt->data, buf, data->au_headers[0].size);
-
+    len -= data->au_headers[0].size;
+    buf += data->au_headers[0].size;
     pkt->stream_index = st->index;
+
+    if (len > 0 && data->nb_au_headers > 1) {
+        data->buf_size = FFMIN(len, sizeof(data->buf));
+        memcpy(data->buf, buf, data->buf_size);
+        data->cur_au_index = 1;
+        data->buf_pos = 0;
+        return 1;
+    }
+
     return 0;
 }
 
@@ -220,10 +252,19 @@ static int parse_sdp_line(AVFormatContext *s, int st_index,
     return 0;
 }
 
+static int init_video(AVFormatContext *s, int st_index, PayloadContext *data)
+{
+    if (st_index < 0)
+        return 0;
+    s->streams[st_index]->need_parsing = AVSTREAM_PARSE_FULL;
+    return 0;
+}
+
 RTPDynamicProtocolHandler ff_mp4v_es_dynamic_handler = {
     .enc_name           = "MP4V-ES",
     .codec_type         = AVMEDIA_TYPE_VIDEO,
     .codec_id           = AV_CODEC_ID_MPEG4,
+    .init               = init_video,
     .parse_sdp_a_line   = parse_sdp_line,
 };