Coverage Report

Created: 2025-08-28 07:12

/src/ffmpeg/libavformat/oggparsevorbis.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (C) 2005  Michael Ahlberg, Måns Rullgård
3
 *
4
 * Permission is hereby granted, free of charge, to any person
5
 * obtaining a copy of this software and associated documentation
6
 * files (the "Software"), to deal in the Software without
7
 * restriction, including without limitation the rights to use, copy,
8
 * modify, merge, publish, distribute, sublicense, and/or sell copies
9
 * of the Software, and to permit persons to whom the Software is
10
 * furnished to do so, subject to the following conditions:
11
 *
12
 *  The above copyright notice and this permission notice shall be
13
 *  included in all copies or substantial portions of the Software.
14
 *
15
 *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16
 *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17
 *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18
 *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
19
 *  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
20
 *  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21
 *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22
 *  DEALINGS IN THE SOFTWARE.
23
 */
24
25
#include <stdlib.h>
26
27
#include "libavutil/avstring.h"
28
#include "libavutil/base64.h"
29
#include "libavutil/dict.h"
30
#include "libavutil/mem.h"
31
32
#include "libavcodec/bytestream.h"
33
#include "libavcodec/vorbis_parser.h"
34
35
#include "avformat.h"
36
#include "demux.h"
37
#include "flac_picture.h"
38
#include "internal.h"
39
#include "oggdec.h"
40
#include "vorbiscomment.h"
41
#include "replaygain.h"
42
43
static int ogm_chapter(AVFormatContext *as, const uint8_t *key, const uint8_t *val)
44
26.0k
{
45
26.0k
    int i, cnum, h, m, s, ms, keylen = strlen(key);
46
26.0k
    AVChapter *chapter = NULL;
47
48
26.0k
    if (keylen < 9 || av_strncasecmp(key, "CHAPTER", 7) || sscanf(key+7, "%03d", &cnum) != 1)
49
20.8k
        return 0;
50
51
5.17k
    if (keylen <= 10) {
52
2.78k
        if (sscanf(val, "%02d:%02d:%02d.%03d", &h, &m, &s, &ms) < 4)
53
436
            return 0;
54
55
2.34k
        avpriv_new_chapter(as, cnum, (AVRational) { 1, 1000 },
56
2.34k
                           ms + 1000 * (s + 60 * (m + 60 * h)),
57
2.34k
                           AV_NOPTS_VALUE, NULL);
58
2.39k
    } else if (!av_strcasecmp(key + keylen - 4, "NAME")) {
59
5.87k
        for (i = 0; i < as->nb_chapters; i++)
60
5.87k
            if (as->chapters[i]->id == cnum) {
61
2.34k
                chapter = as->chapters[i];
62
2.34k
                break;
63
2.34k
            }
64
2.34k
        if (!chapter)
65
0
            return 0;
66
67
2.34k
        av_dict_set(&chapter->metadata, "title", val, 0);
68
2.34k
    } else
69
45
        return 0;
70
71
4.69k
    return 1;
72
5.17k
}
73
74
int ff_vorbis_stream_comment(AVFormatContext *as, AVStream *st,
75
                             const uint8_t *buf, int size)
76
6.58k
{
77
6.58k
    int updates = ff_vorbis_comment(as, &st->metadata, buf, size, 1);
78
79
6.58k
    if (updates > 0) {
80
4.66k
        st->event_flags |= AVSTREAM_EVENT_FLAG_METADATA_UPDATED;
81
4.66k
    }
82
83
6.58k
    return updates;
84
6.58k
}
85
86
/**
87
 * This function temporarily modifies the (const qualified) input buffer
88
 * and reverts its changes before return. The input buffer needs to have
89
 * at least one byte of padding.
90
 */
91
static int vorbis_parse_single_comment(AVFormatContext *as, AVDictionary **m,
92
                                       const uint8_t *buf, uint32_t size,
93
                                       int *updates, int parse_picture)
94
32.3k
{
95
32.3k
    char *t = (char*)buf, *v = memchr(t, '=', size);
96
32.3k
    int tl, vl;
97
32.3k
    char backup;
98
99
32.3k
    if (!v)
100
5.50k
        return 0;
101
102
26.8k
    tl = v - t;
103
26.8k
    vl = size - tl - 1;
104
26.8k
    v++;
105
106
26.8k
    if (!tl || !vl)
107
853
        return 0;
108
109
26.0k
    t[tl]  = 0;
110
111
26.0k
    backup = v[vl];
112
26.0k
    v[vl]  = 0;
113
114
    /* The format in which the pictures are stored is the FLAC format.
115
     * Xiph says: "The binary FLAC picture structure is base64 encoded
116
     * and placed within a VorbisComment with the tag name
117
     * 'METADATA_BLOCK_PICTURE'. This is the preferred and
118
     * recommended way of embedding cover art within VorbisComments."
119
     */
120
26.0k
    if (!av_strcasecmp(t, "METADATA_BLOCK_PICTURE") && parse_picture) {
121
2
        int ret, len = AV_BASE64_DECODE_SIZE(vl);
122
2
        uint8_t *pict = av_malloc(len + AV_INPUT_BUFFER_PADDING_SIZE);
123
124
2
        if (!pict) {
125
0
            av_log(as, AV_LOG_WARNING, "out-of-memory error. Skipping cover art block.\n");
126
0
            goto end;
127
0
        }
128
2
        ret = av_base64_decode(pict, v, len);
129
2
        if (ret > 0)
130
2
            ret = ff_flac_parse_picture(as, &pict, ret, 0);
131
2
        av_freep(&pict);
132
2
        if (ret < 0) {
133
0
            av_log(as, AV_LOG_WARNING, "Failed to parse cover art block.\n");
134
0
            goto end;
135
0
        }
136
26.0k
    } else if (!ogm_chapter(as, t, v)) {
137
21.3k
        (*updates)++;
138
21.3k
        if (av_dict_get(*m, t, NULL, 0))
139
2.57k
            av_dict_set(m, t, ";", AV_DICT_APPEND);
140
21.3k
        av_dict_set(m, t, v, AV_DICT_APPEND);
141
21.3k
    }
142
26.0k
end:
143
26.0k
    t[tl] = '=';
144
26.0k
    v[vl] = backup;
145
146
26.0k
    return 0;
147
26.0k
}
148
149
int ff_vorbis_comment(AVFormatContext *as, AVDictionary **m,
150
                      const uint8_t *buf, int size,
151
                      int parse_picture)
152
37.6k
{
153
37.6k
    const uint8_t *p   = buf;
154
37.6k
    const uint8_t *end = buf + size;
155
37.6k
    int updates        = 0;
156
37.6k
    unsigned n;
157
37.6k
    int s, ret;
158
159
    /* must have vendor_length and user_comment_list_length */
160
37.6k
    if (size < 8)
161
7.70k
        return AVERROR_INVALIDDATA;
162
163
29.9k
    s = bytestream_get_le32(&p);
164
165
29.9k
    if (end - p - 4 < s || s < 0)
166
2.47k
        return AVERROR_INVALIDDATA;
167
168
27.4k
    p += s;
169
170
27.4k
    n = bytestream_get_le32(&p);
171
172
59.7k
    while (end - p >= 4 && n > 0) {
173
39.1k
        s = bytestream_get_le32(&p);
174
175
39.1k
        if (end - p < s || s < 0)
176
6.78k
            break;
177
178
32.3k
        ret = vorbis_parse_single_comment(as, m, p, s, &updates, parse_picture);
179
32.3k
        if (ret < 0)
180
0
            return ret;
181
32.3k
        p += s;
182
32.3k
        n--;
183
32.3k
    }
184
185
27.4k
    if (p != end)
186
10.0k
        av_log(as, AV_LOG_INFO,
187
10.0k
               "%"PTRDIFF_SPECIFIER" bytes of comment header remain\n", end - p);
188
27.4k
    if (n > 0)
189
13.6k
        av_log(as, AV_LOG_INFO,
190
13.6k
               "truncated comment header, %i comments not found\n", n);
191
192
27.4k
    ff_metadata_conv(m, NULL, ff_vorbiscomment_metadata_conv);
193
194
27.4k
    return updates;
195
27.4k
}
196
197
/*
198
 * Parse the vorbis header
199
 *
200
 * Vorbis Identification header from Vorbis_I_spec.html#vorbis-spec-codec
201
 * [vorbis_version] = read 32 bits as unsigned integer | Not used
202
 * [audio_channels] = read 8 bit integer as unsigned | Used
203
 * [audio_sample_rate] = read 32 bits as unsigned integer | Used
204
 * [bitrate_maximum] = read 32 bits as signed integer | Not used yet
205
 * [bitrate_nominal] = read 32 bits as signed integer | Not used yet
206
 * [bitrate_minimum] = read 32 bits as signed integer | Used as bitrate
207
 * [blocksize_0] = read 4 bits as unsigned integer | Not Used
208
 * [blocksize_1] = read 4 bits as unsigned integer | Not Used
209
 * [framing_flag] = read one bit | Not Used
210
 */
211
212
struct oggvorbis_private {
213
    unsigned int len[3];
214
    unsigned char *packet[3];
215
    AVVorbisParseContext *vp;
216
    int64_t final_pts;
217
    int final_duration;
218
};
219
220
static int fixup_vorbis_headers(AVFormatContext *as,
221
                                struct oggvorbis_private *priv,
222
                                uint8_t **buf)
223
870
{
224
870
    int i, offset, len, err;
225
870
    int buf_len;
226
870
    unsigned char *ptr;
227
228
870
    len = priv->len[0] + priv->len[1] + priv->len[2];
229
870
    buf_len = len + len / 255 + 64;
230
231
870
    if (*buf)
232
0
        return AVERROR_INVALIDDATA;
233
234
870
    ptr = *buf = av_realloc(NULL, buf_len);
235
870
    if (!ptr)
236
0
        return AVERROR(ENOMEM);
237
870
    memset(*buf, '\0', buf_len);
238
239
870
    ptr[0]  = 2;
240
870
    offset  = 1;
241
870
    offset += av_xiphlacing(&ptr[offset], priv->len[0]);
242
870
    offset += av_xiphlacing(&ptr[offset], priv->len[1]);
243
3.48k
    for (i = 0; i < 3; i++) {
244
2.61k
        memcpy(&ptr[offset], priv->packet[i], priv->len[i]);
245
2.61k
        offset += priv->len[i];
246
2.61k
        av_freep(&priv->packet[i]);
247
2.61k
    }
248
870
    if ((err = av_reallocp(buf, offset + AV_INPUT_BUFFER_PADDING_SIZE)) < 0)
249
0
        return err;
250
870
    return offset;
251
870
}
252
253
static void vorbis_cleanup(AVFormatContext *s, int idx)
254
1.52k
{
255
1.52k
    struct ogg *ogg = s->priv_data;
256
1.52k
    struct ogg_stream *os = ogg->streams + idx;
257
1.52k
    struct oggvorbis_private *priv = os->private;
258
1.52k
    int i;
259
1.52k
    if (os->private) {
260
1.52k
        av_vorbis_parse_free(&priv->vp);
261
6.09k
        for (i = 0; i < 3; i++)
262
4.57k
            av_freep(&priv->packet[i]);
263
1.52k
    }
264
1.52k
}
265
266
static int vorbis_update_metadata(AVFormatContext *s, int idx)
267
4.42k
{
268
4.42k
    struct ogg *ogg = s->priv_data;
269
4.42k
    struct ogg_stream *os = ogg->streams + idx;
270
4.42k
    AVStream *st = s->streams[idx];
271
4.42k
    int ret;
272
273
4.42k
    if (os->psize <= 8)
274
134
        return 0;
275
276
    /* New metadata packet; release old data. */
277
4.28k
    av_dict_free(&st->metadata);
278
4.28k
    ret = ff_vorbis_stream_comment(s, st, os->buf + os->pstart + 7,
279
4.28k
                                   os->psize - 8);
280
4.28k
    if (ret < 0)
281
0
        return ret;
282
283
    /* Update the metadata if possible. */
284
4.28k
    av_freep(&os->new_metadata);
285
4.28k
    if (st->metadata) {
286
3.87k
        os->new_metadata = av_packet_pack_dictionary(st->metadata, &os->new_metadata_size);
287
    /* Send an empty dictionary to indicate that metadata has been cleared. */
288
3.87k
    } else {
289
410
        os->new_metadata = av_mallocz(1);
290
410
        os->new_metadata_size = 0;
291
410
    }
292
293
4.28k
    return ret;
294
4.28k
}
295
296
static int vorbis_parse_header(AVFormatContext *s, AVStream *st,
297
                               const uint8_t *p, unsigned int psize)
298
1.62k
{
299
1.62k
    unsigned blocksize, bs0, bs1;
300
1.62k
    int srate;
301
1.62k
    int channels;
302
303
1.62k
    if (psize != 30)
304
29
        return AVERROR_INVALIDDATA;
305
306
1.60k
    p += 7; /* skip "\001vorbis" tag */
307
308
1.60k
    if (bytestream_get_le32(&p) != 0) /* vorbis_version */
309
2
        return AVERROR_INVALIDDATA;
310
311
1.59k
    channels = bytestream_get_byte(&p);
312
1.59k
    if (st->codecpar->ch_layout.nb_channels &&
313
1.59k
        channels != st->codecpar->ch_layout.nb_channels) {
314
2
        av_log(s, AV_LOG_ERROR, "Channel change is not supported\n");
315
2
        return AVERROR_PATCHWELCOME;
316
2
    }
317
1.59k
    st->codecpar->ch_layout.nb_channels = channels;
318
1.59k
    srate               = bytestream_get_le32(&p);
319
1.59k
    p += 4; // skip maximum bitrate
320
1.59k
    st->codecpar->bit_rate = bytestream_get_le32(&p); // nominal bitrate
321
1.59k
    p += 4; // skip minimum bitrate
322
323
1.59k
    blocksize = bytestream_get_byte(&p);
324
1.59k
    bs0       = blocksize & 15;
325
1.59k
    bs1       = blocksize >> 4;
326
327
1.59k
    if (bs0 > bs1)
328
2
        return AVERROR_INVALIDDATA;
329
1.59k
    if (bs0 < 6 || bs1 > 13)
330
9
        return AVERROR_INVALIDDATA;
331
332
1.58k
    if (bytestream_get_byte(&p) != 1) /* framing_flag */
333
2
        return AVERROR_INVALIDDATA;
334
335
1.58k
    st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
336
1.58k
    st->codecpar->codec_id   = AV_CODEC_ID_VORBIS;
337
338
1.58k
    if (srate > 0) {
339
1.46k
        if (st->codecpar->sample_rate &&
340
1.46k
            srate != st->codecpar->sample_rate) {
341
1
            av_log(s, AV_LOG_ERROR, "Sample rate change is not supported\n");
342
1
            return AVERROR_PATCHWELCOME;
343
1
        }
344
345
1.46k
        st->codecpar->sample_rate = srate;
346
1.46k
        avpriv_set_pts_info(st, 64, 1, srate);
347
1.46k
    }
348
349
1.58k
    return 1;
350
1.58k
}
351
352
static int vorbis_header(AVFormatContext *s, int idx)
353
4.42k
{
354
4.42k
    struct ogg *ogg = s->priv_data;
355
4.42k
    AVStream *st    = s->streams[idx];
356
4.42k
    struct ogg_stream *os = ogg->streams + idx;
357
4.42k
    struct oggvorbis_private *priv;
358
4.42k
    int pkt_type = os->buf[os->pstart];
359
360
4.42k
    if (!os->private) {
361
1.52k
        os->private = av_mallocz(sizeof(struct oggvorbis_private));
362
1.52k
        if (!os->private)
363
0
            return AVERROR(ENOMEM);
364
1.52k
    }
365
366
4.42k
    priv = os->private;
367
368
4.42k
    if (!(pkt_type & 1))
369
566
        return priv->vp ? 0 : AVERROR_INVALIDDATA;
370
371
3.85k
    if (pkt_type > 5) {
372
289
        av_log(s, AV_LOG_VERBOSE, "Ignoring packet with unknown type %d\n", pkt_type);
373
289
        return 1;
374
289
    }
375
376
3.56k
    if (os->psize < 1)
377
2
        return AVERROR_INVALIDDATA;
378
379
3.56k
    if (priv->packet[pkt_type >> 1])
380
32
        return AVERROR_INVALIDDATA;
381
3.53k
    if (pkt_type > 1 && !priv->packet[0] || pkt_type > 3 && !priv->packet[1])
382
135
        return priv->vp ? 0 : AVERROR_INVALIDDATA;
383
384
3.39k
    priv->len[pkt_type >> 1]    = os->psize;
385
3.39k
    priv->packet[pkt_type >> 1] = av_memdup(os->buf + os->pstart, os->psize);
386
3.39k
    if (!priv->packet[pkt_type >> 1])
387
0
        return AVERROR(ENOMEM);
388
3.39k
    if (pkt_type == 1)
389
1.62k
        return vorbis_parse_header(s, st, os->buf + os->pstart, os->psize);
390
391
1.76k
    if (pkt_type == 3) {
392
889
        if (vorbis_update_metadata(s, idx) >= 0 && priv->len[1] > 10) {
393
889
            unsigned new_len;
394
395
889
            int ret = ff_replaygain_export(st, st->metadata);
396
889
            if (ret < 0)
397
0
                return ret;
398
399
            // drop all metadata we parsed and which is not required by libvorbis
400
889
            new_len = 7 + 4 + AV_RL32(priv->packet[1] + 7) + 4 + 1;
401
889
            if (new_len >= 16 && new_len < os->psize) {
402
730
                AV_WL32(priv->packet[1] + new_len - 5, 0);
403
730
                priv->packet[1][new_len - 1] = 1;
404
730
                priv->len[1]                 = new_len;
405
730
            }
406
889
        }
407
889
    } else {
408
878
        int ret;
409
410
878
        if (priv->vp)
411
8
             return AVERROR_INVALIDDATA;
412
413
870
        ret = fixup_vorbis_headers(s, priv, &st->codecpar->extradata);
414
870
        if (ret < 0) {
415
0
            st->codecpar->extradata_size = 0;
416
0
            return ret;
417
0
        }
418
870
        st->codecpar->extradata_size = ret;
419
420
870
        priv->vp = av_vorbis_parse_init(st->codecpar->extradata, st->codecpar->extradata_size);
421
870
        if (!priv->vp) {
422
48
            av_freep(&st->codecpar->extradata);
423
48
            st->codecpar->extradata_size = 0;
424
48
            return AVERROR_UNKNOWN;
425
48
        }
426
870
    }
427
428
1.71k
    return 1;
429
1.76k
}
430
431
static int vorbis_packet(AVFormatContext *s, int idx)
432
148k
{
433
148k
    struct ogg *ogg = s->priv_data;
434
148k
    struct ogg_stream *os = ogg->streams + idx;
435
148k
    struct oggvorbis_private *priv = os->private;
436
148k
    int duration, flags = 0;
437
438
148k
    if (!priv->vp)
439
0
        return AVERROR_INVALIDDATA;
440
441
    /* first packet handling
442
     * here we parse the duration of each packet in the first page and compare
443
     * the total duration to the page granule to find the encoder delay and
444
     * set the first timestamp */
445
148k
    if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS) && (int64_t)os->granule>=0) {
446
128k
        int seg, d;
447
128k
        uint8_t *last_pkt  = os->buf + os->pstart;
448
128k
        uint8_t *next_pkt  = last_pkt;
449
450
128k
        av_vorbis_parse_reset(priv->vp);
451
128k
        duration = 0;
452
128k
        seg = os->segp;
453
128k
        d = av_vorbis_parse_frame_flags(priv->vp, last_pkt, 1, &flags);
454
128k
        if (d < 0) {
455
0
            os->pflags |= AV_PKT_FLAG_CORRUPT;
456
0
            return 0;
457
128k
        } else if (flags & VORBIS_FLAG_COMMENT) {
458
1.81k
            vorbis_update_metadata(s, idx);
459
1.81k
            flags = 0;
460
1.81k
        }
461
128k
        duration += d;
462
128k
        last_pkt = next_pkt =  next_pkt + os->psize;
463
2.99M
        for (; seg < os->nsegs; seg++) {
464
2.86M
            if (os->segments[seg] < 255) {
465
2.70M
                int d = av_vorbis_parse_frame_flags(priv->vp, last_pkt, 1, &flags);
466
2.70M
                if (d < 0) {
467
0
                    duration = os->granule;
468
0
                    break;
469
2.70M
                } else if (flags & VORBIS_FLAG_COMMENT) {
470
0
                    vorbis_update_metadata(s, idx);
471
0
                    flags = 0;
472
0
                }
473
2.70M
                duration += d;
474
2.70M
                last_pkt  = next_pkt + os->segments[seg];
475
2.70M
            }
476
2.86M
            next_pkt += os->segments[seg];
477
2.86M
        }
478
128k
        os->lastpts                 =
479
128k
        os->lastdts                 = os->granule - duration;
480
481
128k
        if (!os->granule && duration) //hack to deal with broken files (Ticket3710)
482
91.1k
            os->lastpts = os->lastdts = AV_NOPTS_VALUE;
483
484
128k
        if (s->streams[idx]->start_time == AV_NOPTS_VALUE) {
485
534
            s->streams[idx]->start_time = FFMAX(os->lastpts, 0);
486
534
            if (s->streams[idx]->duration != AV_NOPTS_VALUE)
487
180
                s->streams[idx]->duration -= s->streams[idx]->start_time;
488
534
        }
489
128k
        priv->final_pts          = AV_NOPTS_VALUE;
490
128k
        av_vorbis_parse_reset(priv->vp);
491
128k
    }
492
493
    /* parse packet duration */
494
148k
    if (os->psize > 0) {
495
68.0k
        duration = av_vorbis_parse_frame_flags(priv->vp, os->buf + os->pstart, 1, &flags);
496
68.0k
        if (duration < 0) {
497
0
            os->pflags |= AV_PKT_FLAG_CORRUPT;
498
0
            return 0;
499
68.0k
        } else if (flags & VORBIS_FLAG_COMMENT) {
500
1.71k
            vorbis_update_metadata(s, idx);
501
1.71k
            flags = 0;
502
1.71k
        }
503
68.0k
        os->pduration = duration;
504
68.0k
    }
505
506
    /* final packet handling
507
     * here we save the pts of the first packet in the final page, sum up all
508
     * packet durations in the final page except for the last one, and compare
509
     * to the page granule to find the duration of the final packet */
510
148k
    if (os->flags & OGG_FLAG_EOS) {
511
11.3k
        if (os->lastpts != AV_NOPTS_VALUE) {
512
1.03k
            priv->final_pts      = os->lastpts;
513
1.03k
            priv->final_duration = 0;
514
1.03k
        }
515
11.3k
        if (os->segp == os->nsegs) {
516
1.03k
            int64_t skip = priv->final_pts + priv->final_duration + os->pduration - os->granule;
517
1.03k
            if (skip > 0)
518
729
                os->end_trimming = skip;
519
1.03k
            os->pduration = os->granule - priv->final_pts - priv->final_duration;
520
1.03k
        }
521
11.3k
        priv->final_duration += os->pduration;
522
11.3k
    }
523
524
148k
    return 0;
525
148k
}
526
527
const struct ogg_codec ff_vorbis_codec = {
528
    .magic     = "\001vorbis",
529
    .magicsize = 7,
530
    .header    = vorbis_header,
531
    .packet    = vorbis_packet,
532
    .cleanup   = vorbis_cleanup,
533
    .nb_header = 3,
534
};