]> git.sesse.net Git - vlc/blobdiff - modules/codec/speex.c
Fix for [oCERT-2008-004] multiple speex implementations insufficient boundary checks...
[vlc] / modules / codec / speex.c
old mode 100755 (executable)
new mode 100644 (file)
index 4c35300..83890bb
@@ -1,16 +1,16 @@
 /*****************************************************************************
- * speex.c: speex decoder module making use of libspeex.
+ * speex.c: speex decoder/packetizer/encoder module making use of libspeex.
  *****************************************************************************
- * Copyright (C) 1999-2001 VideoLAN
- * $Id: speex.c,v 1.1 2003/10/22 17:12:30 gbazin Exp $
+ * Copyright (C) 2003 the VideoLAN team
+ * $Id$
  *
- * Authors: Gildas Bazin <gbazin@netcourrier.com>
+ * Authors: Gildas Bazin <gbazin@videolan.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  *****************************************************************************/
 
 /*****************************************************************************
  * Preamble
  *****************************************************************************/
-#include <stdlib.h>                                      /* malloc(), free() */
-#include <string.h>                                    /* memcpy(), memset() */
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
 
 #include <vlc/vlc.h>
-#include <vlc/aout.h>
-#include <vlc/decoder.h>
-#include <vlc/input.h>
-#include <vlc/sout.h>
-#include <input_ext-dec.h>
-
-#include <vlc/input.h>
+#include <vlc_input.h>
+#include <vlc_codec.h>
+#include <vlc_aout.h>
 
 #include <ogg/ogg.h>
-#include <speex.h>
-#include "speex_header.h"
-#include "speex_stereo.h"
-#include "speex_callbacks.h"
+#include <speex/speex.h>
+#include <speex/speex_header.h>
+#include <speex/speex_stereo.h>
+#include <speex/speex_callbacks.h>
+
+#include <assert.h>
 
 /*****************************************************************************
  * decoder_sys_t : speex decoder descriptor
 struct decoder_sys_t
 {
     /* Module mode */
-    vlc_bool_t b_packetizer;
+    bool b_packetizer;
 
     /*
      * Input properties
      */
     int i_headers;
+    int i_frame_in_packet;
 
     /*
      * Speex properties
@@ -62,24 +62,12 @@ struct decoder_sys_t
     SpeexHeader *p_header;
     SpeexStereoState stereo;
     void *p_state;
-
-    /*
-     * Output properties
-     */
-    aout_instance_t        *p_aout;
-    aout_input_t           *p_aout_input;
-    audio_sample_format_t   aout_format;
-
-    /*
-     * Packetizer output properties
-     */
-    sout_packetizer_input_t *p_sout_input;
-    sout_format_t           sout_format;
+    unsigned int rtp_rate;
 
     /*
      * Common properties
      */
-    audio_date_t          end_date;
+    audio_date_t end_date;
 
 };
 
@@ -97,32 +85,45 @@ static int pi_channels_maps[6] =
 /****************************************************************************
  * Local prototypes
  ****************************************************************************/
-static int OpenDecoder   ( vlc_object_t * );
-static int OpenPacketizer( vlc_object_t * );
+static int  OpenDecoder   ( vlc_object_t * );
+static int  OpenPacketizer( vlc_object_t * );
+static void CloseDecoder  ( vlc_object_t * );
 
-static int InitDecoder   ( decoder_t * );
-static int RunDecoder    ( decoder_t *, block_t * );
-static int EndDecoder    ( decoder_t * );
+static void *DecodeBlock  ( decoder_t *, block_t ** );
+static aout_buffer_t *DecodeRtpSpeexPacket( decoder_t *, block_t **);
+static int  ProcessHeaders( decoder_t * );
+static int  ProcessInitialHeader ( decoder_t *, ogg_packet * );
+static void *ProcessPacket( decoder_t *, ogg_packet *, block_t ** );
 
-static int ProcessHeader ( decoder_t *, ogg_packet * );
-static int ProcessPacket ( decoder_t *, ogg_packet *, mtime_t );
-static int DecodePacket  ( decoder_t *, ogg_packet * );
-static int SendPacket    ( decoder_t *, ogg_packet * );
+static aout_buffer_t *DecodePacket( decoder_t *, ogg_packet * );
+static block_t *SendPacket( decoder_t *, block_t * );
 
 static void ParseSpeexComments( decoder_t *, ogg_packet * );
 
+static int OpenEncoder   ( vlc_object_t * );
+static void CloseEncoder ( vlc_object_t * );
+static block_t *Encode   ( encoder_t *, aout_buffer_t * );
+
 /*****************************************************************************
  * Module descriptor
  *****************************************************************************/
 vlc_module_begin();
+    set_category( CAT_INPUT );
+    set_subcategory( SUBCAT_INPUT_ACODEC );
+
     set_description( _("Speex audio decoder") );
     set_capability( "decoder", 100 );
-    set_callbacks( OpenDecoder, NULL );
+    set_callbacks( OpenDecoder, CloseDecoder );
 
     add_submodule();
     set_description( _("Speex audio packetizer") );
     set_capability( "packetizer", 100 );
-    set_callbacks( OpenPacketizer, NULL );
+    set_callbacks( OpenPacketizer, CloseDecoder );
+
+    add_submodule();
+    set_description( _("Speex audio encoder") );
+    set_capability( "encoder", 100 );
+    set_callbacks( OpenEncoder, CloseEncoder );
 vlc_module_end();
 
 /*****************************************************************************
@@ -131,24 +132,56 @@ vlc_module_end();
 static int OpenDecoder( vlc_object_t *p_this )
 {
     decoder_t *p_dec = (decoder_t*)p_this;
+    decoder_sys_t *p_sys = p_dec->p_sys;
 
-    if( p_dec->p_fifo->i_fourcc != VLC_FOURCC('s','p','x',' ') )
+    if( p_dec->fmt_in.i_codec != VLC_FOURCC('s','p','x',' ') 
+        && p_dec->fmt_in.i_codec != VLC_FOURCC('s', 'p', 'x', 'r') )
     {
         return VLC_EGENERIC;
     }
 
-    p_dec->pf_init = InitDecoder;
-    p_dec->pf_decode = RunDecoder;
-    p_dec->pf_end = EndDecoder;
-
     /* Allocate the memory needed to store the decoder's structure */
-    if( ( p_dec->p_sys =
+    if( ( p_dec->p_sys = p_sys =
           (decoder_sys_t *)malloc(sizeof(decoder_sys_t)) ) == NULL )
     {
         msg_Err( p_dec, "out of memory" );
         return VLC_EGENERIC;
     }
-    p_dec->p_sys->b_packetizer = VLC_FALSE;
+    p_dec->p_sys->bits.buf_size = 0;
+    p_dec->p_sys->b_packetizer = false;
+    p_dec->p_sys->rtp_rate = p_dec->fmt_in.audio.i_rate;
+
+    aout_DateSet( &p_sys->end_date, 0 );
+
+    /* Set output properties */
+    p_dec->fmt_out.i_cat = AUDIO_ES;
+    p_dec->fmt_out.i_codec = AOUT_FMT_S16_NE;
+
+    /*
+      Set callbacks
+      If the codec is spxr then this decoder is 
+      being invoked on a Speex stream arriving via RTP. 
+      A special decoder callback is used.
+    */
+    if (p_dec->fmt_in.i_codec == VLC_FOURCC('s', 'p', 'x', 'r'))
+    {
+        msg_Dbg( p_dec, "Using RTP version of Speex decoder @ rate %d.", 
+           p_dec->fmt_in.audio.i_rate );
+        p_dec->pf_decode_audio = (aout_buffer_t *(*)(decoder_t *, block_t **))
+            DecodeRtpSpeexPacket;
+    }
+    else
+    {
+        p_dec->pf_decode_audio = (aout_buffer_t *(*)(decoder_t *, block_t **))
+            DecodeBlock;
+    }
+    p_dec->pf_packetize    = (block_t *(*)(decoder_t *, block_t **))
+        DecodeBlock;
+
+    p_sys->i_headers = 0;
+    p_sys->p_state = NULL;
+    p_sys->p_header = NULL;
+    p_sys->i_frame_in_packet = 0;
 
     return VLC_SUCCESS;
 }
@@ -159,207 +192,216 @@ static int OpenPacketizer( vlc_object_t *p_this )
 
     int i_ret = OpenDecoder( p_this );
 
-    if( i_ret == VLC_SUCCESS ) p_dec->p_sys->b_packetizer = VLC_TRUE;
+    if( i_ret == VLC_SUCCESS )
+    {
+        p_dec->p_sys->b_packetizer = true;
+        p_dec->fmt_out.i_codec = VLC_FOURCC('s','p','x',' ');
+    }
 
     return i_ret;
 }
 
-/*****************************************************************************
- * InitDecoder: Initalize the decoder
- *****************************************************************************/
-static int InitDecoder( decoder_t *p_dec )
-{
-    decoder_sys_t *p_sys = p_dec->p_sys;
-
-    aout_DateSet( &p_sys->end_date, 0 );
-
-    p_sys->p_aout = NULL;
-    p_sys->p_aout_input = NULL;
-    p_sys->aout_format.i_format = VLC_FOURCC('s','p','x',' ');
-
-    p_sys->p_sout_input = NULL;
-    p_sys->sout_format.i_cat = AUDIO_ES;
-    p_sys->sout_format.i_fourcc = VLC_FOURCC( 's', 'p', 'x', ' ' );
-    p_sys->sout_format.i_block_align = 0;
-    p_sys->sout_format.i_bitrate     = 0;
-    p_sys->sout_format.i_extra_data  = 0;
-    p_sys->sout_format.p_extra_data  = NULL;
-
-    p_sys->i_headers = 0;
-    p_sys->p_state = NULL;
-    p_sys->p_header = NULL;
-
-    return VLC_SUCCESS;
-}
-
 /****************************************************************************
- * RunDecoder: the whole thing
+ * DecodeBlock: the whole thing
  ****************************************************************************
  * This function must be fed with ogg packets.
  ****************************************************************************/
-static int RunDecoder( decoder_t *p_dec, block_t *p_block )
+static void *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
     ogg_packet oggpacket;
-    int i_ret;
 
-    /* Block to Ogg packet */
-    oggpacket.packet = p_block->p_buffer;
-    oggpacket.bytes = p_block->i_buffer;
+    if( !pp_block ) return NULL;
+
+    if( *pp_block )
+    {
+        /* Block to Ogg packet */
+        oggpacket.packet = (*pp_block)->p_buffer;
+        oggpacket.bytes = (*pp_block)->i_buffer;
+    }
+    else
+    {
+        if( p_sys->b_packetizer ) return NULL;
+
+        /* Block to Ogg packet */
+        oggpacket.packet = NULL;
+        oggpacket.bytes = 0;
+    }
+
     oggpacket.granulepos = -1;
     oggpacket.b_o_s = 0;
     oggpacket.e_o_s = 0;
     oggpacket.packetno = 0;
 
-    if( p_sys->i_headers == 0 )
+    /* Check for headers */
+    if( p_sys->i_headers == 0 && p_dec->fmt_in.i_extra )
     {
-        /* Take care of the initial Speex header */
-        if( ProcessHeader( p_dec, &oggpacket ) != VLC_SUCCESS )
-        {
-            msg_Err( p_dec, "Initial Speex header is corrupted" );
-            return VLC_EGENERIC;
-        }
+        p_sys->i_headers = 2;
+    }
+    else if( oggpacket.bytes && p_sys->i_headers < 2 )
+    {
+        uint8_t *p_extra;
 
+        p_dec->fmt_in.p_extra =
+            realloc( p_dec->fmt_in.p_extra, p_dec->fmt_in.i_extra +
+                     oggpacket.bytes + 2 );
+        p_extra = ((uint8_t *)p_dec->fmt_in.p_extra) + p_dec->fmt_in.i_extra;
+        *(p_extra++) = oggpacket.bytes >> 8;
+        *(p_extra++) = oggpacket.bytes & 0xFF;
+
+        memcpy( p_extra, oggpacket.packet, oggpacket.bytes );
+        p_dec->fmt_in.i_extra += oggpacket.bytes + 2;
+
+        block_Release( *pp_block );
         p_sys->i_headers++;
+        return NULL;
+    }
 
-        if( p_sys->b_packetizer )
-        {
-            i_ret = ProcessPacket( p_dec, &oggpacket, p_block->i_pts );
-            block_Release( p_block );
-            return i_ret;
-        }
-        else
+    if( p_sys->i_headers == 2 )
+    {
+        if( ProcessHeaders( p_dec ) != VLC_SUCCESS )
         {
-            block_Release( p_block );
-            return VLC_SUCCESS;
+            p_sys->i_headers = 0;
+            p_dec->fmt_in.i_extra = 0;
+            block_Release( *pp_block );
+            return NULL;
         }
+        else p_sys->i_headers++;
     }
 
-    if( p_sys->i_headers == 1 )
+    return ProcessPacket( p_dec, &oggpacket, pp_block );
+}
+
+/*****************************************************************************
+ * ProcessHeaders: process Speex headers.
+ *****************************************************************************/
+static int ProcessHeaders( decoder_t *p_dec )
+{
+    decoder_sys_t *p_sys = p_dec->p_sys;
+    ogg_packet oggpacket;
+    uint8_t *p_extra;
+    int i_extra;
+
+    if( !p_dec->fmt_in.i_extra ) return VLC_EGENERIC;
+
+    oggpacket.granulepos = -1;
+    oggpacket.b_o_s = 1; /* yes this actually is a b_o_s packet :) */
+    oggpacket.e_o_s = 0;
+    oggpacket.packetno = 0;
+    p_extra = p_dec->fmt_in.p_extra;
+    i_extra = p_dec->fmt_in.i_extra;
+
+    /* Take care of the initial Vorbis header */
+    oggpacket.bytes = *(p_extra++) << 8;
+    oggpacket.bytes |= (*(p_extra++) & 0xFF);
+    oggpacket.packet = p_extra;
+    p_extra += oggpacket.bytes;
+    i_extra -= (oggpacket.bytes + 2);
+    if( i_extra < 0 )
     {
-        /* The next packet in order is the comments header */
-        ParseSpeexComments( p_dec, &oggpacket );
-        p_sys->i_headers++;
+        msg_Err( p_dec, "header data corrupted");
+        return VLC_EGENERIC;
+    }
 
-        if( p_sys->b_packetizer )
-        {
-            i_ret = ProcessPacket( p_dec, &oggpacket, p_block->i_pts );
-            block_Release( p_block );
-            return i_ret;
-        }
-        else
-        {
-            block_Release( p_block );
-            return VLC_SUCCESS;
-        }
+    /* Take care of the initial Speex header */
+    if( ProcessInitialHeader( p_dec, &oggpacket ) != VLC_SUCCESS )
+    {
+        msg_Err( p_dec, "initial Speex header is corrupted" );
+        return VLC_EGENERIC;
     }
 
-    if( p_sys->i_headers < p_sys->p_header->extra_headers + 2 )
+    /* The next packet in order is the comments header */
+    oggpacket.b_o_s = 0;
+    oggpacket.bytes = *(p_extra++) << 8;
+    oggpacket.bytes |= (*(p_extra++) & 0xFF);
+    oggpacket.packet = p_extra;
+    p_extra += oggpacket.bytes;
+    i_extra -= (oggpacket.bytes + 2);
+    if( i_extra < 0 )
     {
-        /* Skip them for now */
-        p_sys->i_headers++;
-    
-        if( p_sys->b_packetizer )
-        {
-            i_ret = ProcessPacket( p_dec, &oggpacket, p_block->i_pts );
-            block_Release( p_block );
-            return i_ret;
-        }
-        else
-        {
-            block_Release( p_block );
-            return VLC_SUCCESS;
-        }
+        msg_Err( p_dec, "header data corrupted");
+        return VLC_EGENERIC;
     }
 
-    i_ret = ProcessPacket( p_dec, &oggpacket, p_block->i_pts );
-    block_Release( p_block );
-    return i_ret;
+    ParseSpeexComments( p_dec, &oggpacket );
+
+    if( p_sys->b_packetizer )
+    {
+        p_dec->fmt_out.i_extra = p_dec->fmt_in.i_extra;
+        p_dec->fmt_out.p_extra =
+            realloc( p_dec->fmt_out.p_extra, p_dec->fmt_out.i_extra );
+        memcpy( p_dec->fmt_out.p_extra,
+                p_dec->fmt_in.p_extra, p_dec->fmt_out.i_extra );
+    }
+
+    return VLC_SUCCESS;
 }
 
 /*****************************************************************************
- * ProcessHeader: processes the inital Speex header packet.
+ * ProcessInitialHeader: processes the inital Speex header packet.
  *****************************************************************************/
-static int ProcessHeader( decoder_t *p_dec, ogg_packet *p_oggpacket )
+static int ProcessInitialHeader( decoder_t *p_dec, ogg_packet *p_oggpacket )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
 
     void *p_state;
     SpeexHeader *p_header;
-    SpeexMode *p_mode;
+    const SpeexMode *p_mode;
     SpeexCallback callback;
 
     p_sys->p_header = p_header =
-        speex_packet_to_header( p_oggpacket->packet, p_oggpacket->bytes );
+        speex_packet_to_header( (char *)p_oggpacket->packet,
+                                p_oggpacket->bytes );
     if( !p_header )
     {
-        msg_Err( p_dec, "Cannot read Speex header" );
+        msg_Err( p_dec, "cannot read Speex header" );
         return VLC_EGENERIC;
     }
-    if( p_header->mode >= SPEEX_NB_MODES )
+    if( p_header->mode >= SPEEX_NB_MODES || p_header->mode < 0 )
     {
-        msg_Err( p_dec, "Mode number %d does not (yet/any longer) exist in "
-                 "this version of libspeex", p_header->mode );
+        msg_Err( p_dec, "mode number %d does not (yet/any longer) exist in "
+                 "this version of libspeex.", p_header->mode );
         return VLC_EGENERIC;
     }
 
     p_mode = speex_mode_list[p_header->mode];
+    if( p_mode == NULL )
+        return VLC_EGENERIC;
 
     if( p_header->speex_version_id > 1 )
     {
-        msg_Err( p_dec, "This file was encoded with Speex bit-stream "
-                 "version %d, which I don't know how to decode",
+        msg_Err( p_dec, "this file was encoded with Speex bit-stream "
+                 "version %d which is not supported by this decoder.",
                  p_header->speex_version_id );
         return VLC_EGENERIC;
     }
 
     if( p_mode->bitstream_version < p_header->mode_bitstream_version )
     {
-        msg_Err( p_dec, "File encoded with a newer version of Speex" );
+        msg_Err( p_dec, "file encoded with a newer version of Speex." );
         return VLC_EGENERIC;
     }
-    if( p_mode->bitstream_version > p_header->mode_bitstream_version ) 
+    if( p_mode->bitstream_version > p_header->mode_bitstream_version )
     {
-        msg_Err( p_dec, "File encoded with an older version of Speex" );
+        msg_Err( p_dec, "file encoded with an older version of Speex." );
         return VLC_EGENERIC;
     }
-   
-    msg_Dbg( p_dec, "Speex %d Hz audio using %s mode %s%s", 
+
+    msg_Dbg( p_dec, "Speex %d Hz audio using %s mode %s%s",
              p_header->rate, p_mode->modeName,
              ( p_header->nb_channels == 1 ) ? " (mono" : " (stereo",
              p_header->vbr ? ", VBR)" : ")" );
 
-    aout_DateInit( &p_sys->end_date, p_header->rate );
-
-    if( p_sys->b_packetizer )
-    {
-        /* add an input for the stream ouput */
-        p_sys->sout_format.i_sample_rate = p_header->rate;
-        p_sys->sout_format.i_channels    = p_header->nb_channels;
-        p_sys->sout_format.i_block_align = 1;
-        p_sys->sout_format.i_bitrate     = 0;
-
-        p_sys->p_sout_input = sout_InputNew( p_dec, &p_sys->sout_format );
-        if( !p_sys->p_sout_input )
-        {
-            msg_Err( p_dec, "cannot add a new stream" );
-            return VLC_EGENERIC;
-        }
-
-        /* We're done */
-        return VLC_SUCCESS;
-    }
-
     /* Take care of speex decoder init */
     speex_bits_init( &p_sys->bits );
     p_sys->p_state = p_state = speex_decoder_init( p_mode );
     if( !p_state )
     {
-        msg_Err( p_dec, "Decoder initialization failed" );
+        msg_Err( p_dec, "decoder initialization failed" );
         return VLC_EGENERIC;
     }
 
-    if( p_header->nb_channels == 1 )
+    if( p_header->nb_channels == 2 )
     {
         SpeexStereoState stereo = SPEEX_STEREO_STATE_INIT;
         p_sys->stereo = stereo;
@@ -368,143 +410,338 @@ static int ProcessHeader( decoder_t *p_dec, ogg_packet *p_oggpacket )
         callback.data = &p_sys->stereo;
         speex_decoder_ctl( p_state, SPEEX_SET_HANDLER, &callback );
     }
-
-    p_sys->aout_format.i_format = AOUT_FMT_S16_NE;
-    p_sys->aout_format.i_physical_channels =
-        p_sys->aout_format.i_original_channels =
-            pi_channels_maps[p_header->nb_channels];
-    p_sys->aout_format.i_rate = p_header->rate;
-
-    p_sys->p_aout = NULL;
-    p_sys->p_aout_input = aout_DecNew( p_dec, &p_sys->p_aout,
-                                       &p_sys->aout_format );
-    if( p_sys->p_aout_input == NULL )
+    if( p_header->nb_channels <= 0 ||
+        p_header->nb_channels > 5 )
     {
-        msg_Err( p_dec, "failed to create aout fifo" );
+        msg_Err( p_dec, "invalid number of channels (not between 1 and 5): %i",
+                 p_header->nb_channels );
         return VLC_EGENERIC;
     }
 
+    /* Setup the format */
+    p_dec->fmt_out.audio.i_physical_channels =
+        p_dec->fmt_out.audio.i_original_channels =
+            pi_channels_maps[p_header->nb_channels];
+    p_dec->fmt_out.audio.i_channels = p_header->nb_channels;
+    p_dec->fmt_out.audio.i_rate = p_header->rate;
+
+    aout_DateInit( &p_sys->end_date, p_header->rate );
+
     return VLC_SUCCESS;
 }
 
 /*****************************************************************************
  * ProcessPacket: processes a Speex packet.
  *****************************************************************************/
-static int ProcessPacket( decoder_t *p_dec, ogg_packet *p_oggpacket,
-                          mtime_t i_pts )
+static void *ProcessPacket( decoder_t *p_dec, ogg_packet *p_oggpacket,
+                            block_t **pp_block )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
+    block_t *p_block = *pp_block;
 
     /* Date management */
-    if( i_pts > 0 && i_pts != aout_DateGet( &p_sys->end_date ) )
+    if( p_block && p_block->i_pts > 0 && 
+        p_block->i_pts != aout_DateGet( &p_sys->end_date ) )
     {
-        aout_DateSet( &p_sys->end_date, i_pts );
+        aout_DateSet( &p_sys->end_date, p_block->i_pts );
     }
 
     if( !aout_DateGet( &p_sys->end_date ) )
     {
         /* We've just started the stream, wait for the first PTS. */
-        return VLC_SUCCESS;
+        if( p_block ) block_Release( p_block );
+        return NULL;
     }
 
+    *pp_block = NULL; /* To avoid being fed the same packet again */
+
     if( p_sys->b_packetizer )
     {
-        return SendPacket( p_dec, p_oggpacket );
+       if ( p_sys->p_header->frames_per_packet > 1 )
+       {
+           short *p_frame_holder = NULL;
+           int i_bits_before = 0, i_bits_after = 0, i_bytes_in_speex_frame = 0,
+               i_pcm_output_size = 0, i_bits_in_speex_frame = 0;
+           block_t *p_new_block = NULL;
+
+           i_pcm_output_size = p_sys->p_header->frame_size;
+           p_frame_holder = (short*)malloc( sizeof(short)*i_pcm_output_size );
+
+            speex_bits_read_from( &p_sys->bits, (char*)p_oggpacket->packet,
+               p_oggpacket->bytes);
+            i_bits_before = speex_bits_remaining( &p_sys->bits );
+           speex_decode_int(p_sys->p_state, &p_sys->bits, p_frame_holder);
+           i_bits_after = speex_bits_remaining( &p_sys->bits );
+
+            i_bits_in_speex_frame = i_bits_before - i_bits_after;
+           i_bytes_in_speex_frame = ( i_bits_in_speex_frame + 
+               (8 - (i_bits_in_speex_frame % 8)) )
+                / 8;
+
+            p_new_block = block_New( p_dec, i_bytes_in_speex_frame );
+           memset( p_new_block->p_buffer, 0xff, i_bytes_in_speex_frame );
+
+           /*
+            * Copy the first frame in this packet to a new packet.
+            */
+           speex_bits_rewind( &p_sys->bits );
+           speex_bits_write( &p_sys->bits, 
+               (char*)p_new_block->p_buffer, 
+                   (int)i_bytes_in_speex_frame );
+
+           /*
+            * Move the remaining part of the original packet (subsequent
+            * frames, if there are any) into the beginning 
+            * of the original packet so
+            * they are preserved following the realloc. 
+            * Note: Any bits that
+            * remain in the initial packet
+            * are "filler" if they do not constitute
+            * an entire byte. 
+            */
+           if ( i_bits_after > 7 )
+           {
+               /* round-down since we rounded-up earlier (to include
+                * the speex terminator code. 
+                */
+               i_bytes_in_speex_frame--;
+               speex_bits_write( &p_sys->bits, 
+                       (char*)p_block->p_buffer, 
+                       p_block->i_buffer - i_bytes_in_speex_frame );
+            p_block = block_Realloc( p_block, 
+                   0, 
+                       p_block->i_buffer-i_bytes_in_speex_frame );
+               *pp_block = p_block;
+           }
+           else
+           {
+               speex_bits_reset( &p_sys->bits );
+           }
+
+           free( p_frame_holder );
+           return SendPacket( p_dec, p_new_block);
+       }
+       else
+       {
+            return SendPacket( p_dec, p_block );
+       }
     }
     else
     {
-        return DecodePacket( p_dec, p_oggpacket );
+        aout_buffer_t *p_aout_buffer;
+
+        if( p_sys->i_headers >= p_sys->p_header->extra_headers + 2 )
+            p_aout_buffer = DecodePacket( p_dec, p_oggpacket );
+        else
+            p_aout_buffer = NULL; /* Skip headers */
+
+        if( p_block ) block_Release( p_block );
+        return p_aout_buffer;
+    }
+}
+
+static aout_buffer_t *DecodeRtpSpeexPacket( decoder_t *p_dec, block_t **pp_block )
+{
+    block_t *p_speex_bit_block = *pp_block;
+    decoder_sys_t *p_sys = p_dec->p_sys;
+    aout_buffer_t *p_aout_buffer;
+    int i_decode_ret;
+    unsigned int i_speex_frame_size;
+
+    if ( !p_speex_bit_block || p_speex_bit_block->i_pts == 0 ) return NULL;
+
+    /* 
+      If the SpeexBits buffer size is 0 (a default value),
+      we know that a proper initialization has not yet been done.
+    */
+    if ( p_sys->bits.buf_size==0 )
+    {
+       p_sys->p_header = (SpeexHeader *)malloc(sizeof(SpeexHeader));
+       if ( !p_sys->p_header )
+       {
+           msg_Err( p_dec, "Could not allocate a Speex header.");
+           return NULL;
+       }
+       speex_init_header( p_sys->p_header,p_sys->rtp_rate,1,&speex_nb_mode );
+        speex_bits_init( &p_sys->bits );
+       p_sys->p_state = speex_decoder_init( &speex_nb_mode );
+       if ( !p_sys->p_state )
+       {
+           msg_Err( p_dec, "Could not allocate a Speex decoder." );
+           free( p_sys->p_header );
+           return NULL;
+       }
+
+        /*
+         Assume that variable bit rate is enabled. Also assume
+         that there is only one frame per packet. 
+       */
+       p_sys->p_header->vbr = 1;
+       p_sys->p_header->frames_per_packet = 1;
+
+        p_dec->fmt_out.audio.i_channels = p_sys->p_header->nb_channels;
+       p_dec->fmt_out.audio.i_physical_channels = 
+       p_dec->fmt_out.audio.i_original_channels = 
+           pi_channels_maps[p_sys->p_header->nb_channels];
+        p_dec->fmt_out.audio.i_rate = p_sys->p_header->rate;
+
+        if ( speex_mode_query( &speex_nb_mode, 
+           SPEEX_MODE_FRAME_SIZE, 
+           &i_speex_frame_size ) )
+       {
+           msg_Err( p_dec, "Could not determine the frame size." );
+           speex_decoder_destroy( p_sys->p_state );
+           free( p_sys->p_header );
+           return NULL;
+       }
+       p_dec->fmt_out.audio.i_bytes_per_frame = i_speex_frame_size;
+
+       aout_DateInit(&p_sys->end_date, p_sys->p_header->rate);
     }
+
+    /* 
+      If the SpeexBits are initialized but there is 
+      still no header, an error must be thrown.
+    */
+    if ( !p_sys->p_header )
+    {
+        msg_Err( p_dec, "There is no valid Speex header found." );
+       return NULL;
+    }
+    *pp_block = NULL;
+
+    if ( !aout_DateGet( &p_sys->end_date ) )
+        aout_DateSet( &p_sys->end_date, p_speex_bit_block->i_dts );
+
+    /*
+      Ask for a new audio output buffer and make sure
+      we get one. 
+    */
+    p_aout_buffer = p_dec->pf_aout_buffer_new( p_dec, 
+        p_sys->p_header->frame_size );
+    if ( !p_aout_buffer || p_aout_buffer->i_nb_bytes == 0 )
+    {
+        msg_Err(p_dec, "Oops: No new buffer was returned!");
+       return NULL;
+    }
+
+    /*
+      Read the Speex payload into the SpeexBits buffer.
+    */
+    speex_bits_read_from( &p_sys->bits, 
+        (char*)p_speex_bit_block->p_buffer, 
+        p_speex_bit_block->i_buffer );
+    
+    /* 
+      Decode the input and ensure that no errors 
+      were encountered.
+    */
+    i_decode_ret = speex_decode_int( p_sys->p_state, &p_sys->bits, 
+            (int16_t*)p_aout_buffer->p_buffer );
+    if ( i_decode_ret < 0 )
+    {
+        msg_Err( p_dec, "Decoding failed. Perhaps we have a bad stream?" );
+       return NULL;
+    }
+
+    /* 
+      Handle date management on the audio output buffer. 
+    */
+    p_aout_buffer->start_date = aout_DateGet( &p_sys->end_date );
+    p_aout_buffer->end_date = aout_DateIncrement( &p_sys->end_date, 
+        p_sys->p_header->frame_size );
+    
+    
+    p_sys->i_frame_in_packet++;
+    block_Release( p_speex_bit_block );
+
+    return p_aout_buffer;
 }
 
 /*****************************************************************************
  * DecodePacket: decodes a Speex packet.
  *****************************************************************************/
-static int DecodePacket( decoder_t *p_dec, ogg_packet *p_oggpacket )
+static aout_buffer_t *DecodePacket( decoder_t *p_dec, ogg_packet *p_oggpacket )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
-    int j;
 
-    /* Copy Ogg packet to Speex bitstream */
-    speex_bits_read_from( &p_sys->bits, p_oggpacket->packet,
-                          p_oggpacket->bytes );
+    if( p_oggpacket->bytes )
+    {
+        /* Copy Ogg packet to Speex bitstream */
+        speex_bits_read_from( &p_sys->bits, (char *)p_oggpacket->packet,
+                              p_oggpacket->bytes );
+        p_sys->i_frame_in_packet = 0;
+    }
 
-    /* Decode each frame of the packet */
-    for( j = 0; j != p_sys->p_header->frames_per_packet; j++ )
+    /* Decode one frame at a time */
+    if( p_sys->i_frame_in_packet < p_sys->p_header->frames_per_packet )
     {
         aout_buffer_t *p_aout_buffer;
-        int i_ret;
+        if( p_sys->p_header->frame_size == 0 )
+            return NULL;
 
-        p_aout_buffer = aout_DecNewBuffer( p_sys->p_aout, p_sys->p_aout_input,
-                                           p_sys->p_header->frame_size );
+        p_aout_buffer =
+            p_dec->pf_aout_buffer_new( p_dec, p_sys->p_header->frame_size );
         if( !p_aout_buffer )
         {
-            msg_Err( p_dec, "cannot get aout buffer" );
-            return VLC_SUCCESS;
+            return NULL;
         }
 
-        i_ret = speex_decode( p_sys->p_state, &p_sys->bits,
-                              (int16_t *)p_aout_buffer->p_buffer );
-        if( i_ret == -1 ) break; /* End of stream */
-        if( i_ret== -2 )
+        switch( speex_decode_int( p_sys->p_state, &p_sys->bits,
+                                  (int16_t *)p_aout_buffer->p_buffer ) )
         {
-            msg_Warn( p_dec, "Decoding error: corrupted stream?" );
-            break;
+            case -2:
+                msg_Err( p_dec, "decoding error: corrupted stream?" );
+            case -1: /* End of stream */
+                return NULL;
         }
 
         if( speex_bits_remaining( &p_sys->bits ) < 0 )
         {
-            msg_Warn( p_dec, "Decoding overflow: corrupted stream?" );
-            break;
+            msg_Err( p_dec, "decoding overflow: corrupted stream?" );
         }
 
         if( p_sys->p_header->nb_channels == 2 )
-            speex_decode_stereo( (int16_t *)p_aout_buffer->p_buffer,
-                                 p_sys->p_header->frame_size, &p_sys->stereo );
+            speex_decode_stereo_int( (int16_t *)p_aout_buffer->p_buffer,
+                                     p_sys->p_header->frame_size,
+                                     &p_sys->stereo );
 
         /* Date management */
         p_aout_buffer->start_date = aout_DateGet( &p_sys->end_date );
         p_aout_buffer->end_date =
-            aout_DateIncrement( &p_sys->end_date, p_sys->p_header->frame_size);
+            aout_DateIncrement( &p_sys->end_date, p_sys->p_header->frame_size );
 
-        aout_DecPlay( p_sys->p_aout, p_sys->p_aout_input, p_aout_buffer );
-    }
+        p_sys->i_frame_in_packet++;
 
+        return p_aout_buffer;
+    }
+    else
+    {
+        return NULL;
+    }
 }
 
 /*****************************************************************************
  * SendPacket: send an ogg packet to the stream output.
  *****************************************************************************/
-static int SendPacket( decoder_t *p_dec, ogg_packet *p_oggpacket )
+static block_t *SendPacket( decoder_t *p_dec, block_t *p_block )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
 
-    sout_buffer_t *p_sout_buffer =
-        sout_BufferNew( p_sys->p_sout_input->p_sout, p_oggpacket->bytes );
-
-    if( !p_sout_buffer ) return VLC_EGENERIC;
-
-    p_dec->p_vlc->pf_memcpy( p_sout_buffer->p_buffer,
-                             p_oggpacket->packet,
-                             p_oggpacket->bytes );
-
-    p_sout_buffer->i_bitrate = 0;
-
     /* Date management */
-    p_sout_buffer->i_dts = p_sout_buffer->i_pts =
-        aout_DateGet( &p_sys->end_date );
+    p_block->i_dts = p_block->i_pts = aout_DateGet( &p_sys->end_date );
 
     if( p_sys->i_headers >= p_sys->p_header->extra_headers + 2 )
-        p_sout_buffer->i_length =
+    {
+        p_block->i_length =
             aout_DateIncrement( &p_sys->end_date,
                                 p_sys->p_header->frame_size ) -
-            p_sout_buffer->i_pts;
+            p_block->i_pts;
+    }
     else
-        p_sout_buffer->i_length = 0;
-
-    sout_InputSendBuffer( p_sys->p_sout_input, p_sout_buffer );
+        p_block->i_length = 0;
 
-    return VLC_SUCCESS;
+    return p_block;
 }
 
 /*****************************************************************************
@@ -520,60 +757,280 @@ static void ParseSpeexComments( decoder_t *p_dec, ogg_packet *p_oggpacket )
     input_thread_t *p_input = (input_thread_t *)p_dec->p_parent;
     decoder_sys_t *p_sys = p_dec->p_sys;
 
-    input_info_category_t *p_cat =
-        input_InfoCategory( p_input, _("Speex Comment") );
-
     char *p_buf = (char *)p_oggpacket->packet;
-    SpeexMode *p_mode;
+    const SpeexMode *p_mode;
     int i_len;
 
+    if( p_input->i_object_type != VLC_OBJECT_INPUT ) return;
+
+    assert( p_sys->p_header->mode < SPEEX_NB_MODES );
+
     p_mode = speex_mode_list[p_sys->p_header->mode];
-    input_AddInfo( p_cat, _("Mode"), "%s%s",
-                   p_mode->modeName, p_sys->p_header->vbr ? " VBR" : "" );
+    assert( p_mode != NULL );
+
+    input_Control( p_input, INPUT_ADD_INFO, _("Speex comment"), _("Mode"),
+                   "%s%s", p_mode->modeName,
+                   p_sys->p_header->vbr ? " VBR" : "" );
 
     if( p_oggpacket->bytes < 8 )
     {
-        msg_Warn( p_dec, "Invalid/corrupted comments" );
+        msg_Err( p_dec, "invalid/corrupted comments" );
         return;
     }
 
     i_len = readint( p_buf, 0 ); p_buf += 4;
     if( i_len > p_oggpacket->bytes - 4 )
     {
-        msg_Warn( p_dec, "Invalid/corrupted comments" );
+        msg_Err( p_dec, "invalid/corrupted comments" );
         return;
     }
 
-    input_AddInfo( p_cat, p_buf, "" );
+    input_Control( p_input, INPUT_ADD_INFO, _("Speex comment"), p_buf, "" );
 
     /* TODO: finish comments parsing */
 }
 
 /*****************************************************************************
- * EndDecoder: speex decoder destruction
+ * CloseDecoder: speex decoder destruction
  *****************************************************************************/
-static int EndDecoder( decoder_t * p_dec )
+static void CloseDecoder( vlc_object_t *p_this )
 {
+    decoder_t * p_dec = (decoder_t *)p_this;
     decoder_sys_t *p_sys = p_dec->p_sys;
 
-    if( p_sys->p_aout_input != NULL )
+    if( p_sys->p_state )
     {
-        aout_DecDelete( p_sys->p_aout, p_sys->p_aout_input );
+        speex_decoder_destroy( p_sys->p_state );
+        speex_bits_destroy( &p_sys->bits );
     }
 
-    if( p_sys->p_sout_input != NULL )
+    free( p_sys->p_header );
+    free( p_sys );
+}
+
+/*****************************************************************************
+ * encoder_sys_t: encoder descriptor
+ *****************************************************************************/
+#define MAX_FRAME_SIZE  2000
+#define MAX_FRAME_BYTES 2000
+
+struct encoder_sys_t
+{
+    /*
+     * Input properties
+     */
+    char *p_buffer;
+    char p_buffer_out[MAX_FRAME_BYTES];
+
+    /*
+     * Speex properties
+     */
+    SpeexBits bits;
+    SpeexHeader header;
+    SpeexStereoState stereo;
+    void *p_state;
+
+    int i_frames_per_packet;
+    int i_frames_in_packet;
+
+    int i_frame_length;
+    int i_samples_delay;
+    int i_frame_size;
+
+    /*
+     * Common properties
+     */
+    mtime_t i_pts;
+};
+
+/*****************************************************************************
+ * OpenEncoder: probe the encoder and return score
+ *****************************************************************************/
+static int OpenEncoder( vlc_object_t *p_this )
+{
+    encoder_t *p_enc = (encoder_t *)p_this;
+    encoder_sys_t *p_sys;
+    const SpeexMode *p_speex_mode = &speex_nb_mode;
+    int i_quality, i;
+    const char *pp_header[2];
+    int pi_header[2];
+    uint8_t *p_extra;
+
+    if( p_enc->fmt_out.i_codec != VLC_FOURCC('s','p','x',' ') &&
+        !p_enc->b_force )
     {
-        sout_InputDelete( p_sys->p_sout_input );
+        return VLC_EGENERIC;
     }
 
-    if( p_sys->p_state )
+    /* Allocate the memory needed to store the decoder's structure */
+    if( ( p_sys = (encoder_sys_t *)malloc(sizeof(encoder_sys_t)) ) == NULL )
     {
-        speex_decoder_destroy( p_sys->p_state );
-        speex_bits_destroy( &p_sys->bits );
+        msg_Err( p_enc, "out of memory" );
+        return VLC_EGENERIC;
     }
+    p_enc->p_sys = p_sys;
+    p_enc->pf_encode_audio = Encode;
+    p_enc->fmt_in.i_codec = AOUT_FMT_S16_NE;
+    p_enc->fmt_out.i_codec = VLC_FOURCC('s','p','x',' ');
 
-    if( p_sys->p_header ) free( p_sys->p_header );
-    free( p_sys );
+    speex_init_header( &p_sys->header, p_enc->fmt_in.audio.i_rate,
+                       1, p_speex_mode );
+
+    p_sys->header.frames_per_packet = 1;
+    p_sys->header.vbr = 1;
+    p_sys->header.nb_channels = p_enc->fmt_in.audio.i_channels;
+
+    /* Create a new encoder state in narrowband mode */
+    p_sys->p_state = speex_encoder_init( p_speex_mode );
+
+    /* Set the quality to 8 (15 kbps) */
+    i_quality = 8;
+    speex_encoder_ctl( p_sys->p_state, SPEEX_SET_QUALITY, &i_quality );
+
+    /*Initialization of the structure that holds the bits*/
+    speex_bits_init( &p_sys->bits );
+
+    p_sys->i_frames_in_packet = 0;
+    p_sys->i_samples_delay = 0;
+    p_sys->i_pts = 0;
+
+    speex_encoder_ctl( p_sys->p_state, SPEEX_GET_FRAME_SIZE,
+                       &p_sys->i_frame_length );
+
+    p_sys->i_frame_size = p_sys->i_frame_length *
+        sizeof(int16_t) * p_enc->fmt_in.audio.i_channels;
+    p_sys->p_buffer = malloc( p_sys->i_frame_size );
+
+    /* Create and store headers */
+    pp_header[0] = speex_header_to_packet( &p_sys->header, &pi_header[0] );
+    pp_header[1] = "ENCODER=VLC media player";
+    pi_header[1] = sizeof("ENCODER=VLC media player");
+
+    p_enc->fmt_out.i_extra = 3 * 2 + pi_header[0] + pi_header[1];
+    p_extra = p_enc->fmt_out.p_extra = malloc( p_enc->fmt_out.i_extra );
+    for( i = 0; i < 2; i++ )
+    {
+        *(p_extra++) = pi_header[i] >> 8;
+        *(p_extra++) = pi_header[i] & 0xFF;
+        memcpy( p_extra, pp_header[i], pi_header[i] );
+        p_extra += pi_header[i];
+    }
+
+    msg_Dbg( p_enc, "encoding: frame size:%d, channels:%d, samplerate:%d",
+             p_sys->i_frame_size, p_enc->fmt_in.audio.i_channels,
+             p_enc->fmt_in.audio.i_rate );
 
     return VLC_SUCCESS;
 }
+
+/****************************************************************************
+ * Encode: the whole thing
+ ****************************************************************************
+ * This function spits out ogg packets.
+ ****************************************************************************/
+static block_t *Encode( encoder_t *p_enc, aout_buffer_t *p_aout_buf )
+{
+    encoder_sys_t *p_sys = p_enc->p_sys;
+    block_t *p_block, *p_chain = NULL;
+
+    unsigned char *p_buffer = p_aout_buf->p_buffer;
+    int i_samples = p_aout_buf->i_nb_samples;
+    int i_samples_delay = p_sys->i_samples_delay;
+
+    p_sys->i_pts = p_aout_buf->start_date -
+                (mtime_t)1000000 * (mtime_t)p_sys->i_samples_delay /
+                (mtime_t)p_enc->fmt_in.audio.i_rate;
+
+    p_sys->i_samples_delay += i_samples;
+
+    while( p_sys->i_samples_delay >= p_sys->i_frame_length )
+    {
+        int16_t *p_samples;
+        int i_out;
+
+        if( i_samples_delay )
+        {
+            /* Take care of the left-over from last time */
+            int i_delay_size = i_samples_delay * 2 *
+                                 p_enc->fmt_in.audio.i_channels;
+            int i_size = p_sys->i_frame_size - i_delay_size;
+
+            p_samples = (int16_t *)p_sys->p_buffer;
+            memcpy( p_sys->p_buffer + i_delay_size, p_buffer, i_size );
+            p_buffer -= i_delay_size;
+            i_samples += i_samples_delay;
+            i_samples_delay = 0;
+        }
+        else
+        {
+            p_samples = (int16_t *)p_buffer;
+        }
+
+        /* Encode current frame */
+        if( p_enc->fmt_in.audio.i_channels == 2 )
+            speex_encode_stereo_int( p_samples, p_sys->i_frame_length,
+                                     &p_sys->bits );
+
+#if 0
+        if( p_sys->preprocess )
+            speex_preprocess( p_sys->preprocess, p_samples, NULL );
+#endif
+
+        speex_encode_int( p_sys->p_state, p_samples, &p_sys->bits );
+
+        p_buffer += p_sys->i_frame_size;
+        p_sys->i_samples_delay -= p_sys->i_frame_length;
+        i_samples -= p_sys->i_frame_length;
+
+        p_sys->i_frames_in_packet++;
+
+        if( p_sys->i_frames_in_packet < p_sys->header.frames_per_packet )
+            continue;
+
+        p_sys->i_frames_in_packet = 0;
+
+        speex_bits_insert_terminator( &p_sys->bits );
+        i_out = speex_bits_write( &p_sys->bits, p_sys->p_buffer_out,
+                                  MAX_FRAME_BYTES );
+        speex_bits_reset( &p_sys->bits );
+
+        p_block = block_New( p_enc, i_out );
+        memcpy( p_block->p_buffer, p_sys->p_buffer_out, i_out );
+
+        p_block->i_length = (mtime_t)1000000 *
+            (mtime_t)p_sys->i_frame_length * p_sys->header.frames_per_packet /
+            (mtime_t)p_enc->fmt_in.audio.i_rate;
+
+        p_block->i_dts = p_block->i_pts = p_sys->i_pts;
+
+        /* Update pts */
+        p_sys->i_pts += p_block->i_length;
+        block_ChainAppend( &p_chain, p_block );
+
+    }
+
+    /* Backup the remaining raw samples */
+    if( i_samples )
+    {
+        memcpy( p_sys->p_buffer + i_samples_delay * 2 *
+                p_enc->fmt_in.audio.i_channels, p_buffer,
+                i_samples * 2 * p_enc->fmt_in.audio.i_channels );
+    }
+
+    return p_chain;
+}
+
+/*****************************************************************************
+ * CloseEncoder: encoder destruction
+ *****************************************************************************/
+static void CloseEncoder( vlc_object_t *p_this )
+{
+    encoder_t *p_enc = (encoder_t *)p_this;
+    encoder_sys_t *p_sys = p_enc->p_sys;
+
+    speex_encoder_destroy( p_sys->p_state );
+    speex_bits_destroy( &p_sys->bits );
+
+    free( p_sys->p_buffer );
+    free( p_sys );
+}