Coverage Report

Created: 2025-08-28 07:12

/src/ffmpeg/libavformat/rtpdec_asf.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Microsoft RTP/ASF support.
3
 * Copyright (c) 2008 Ronald S. Bultje
4
 *
5
 * This file is part of FFmpeg.
6
 *
7
 * FFmpeg is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * FFmpeg is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with FFmpeg; if not, write to the Free Software
19
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20
 */
21
22
/**
23
 * @file
24
 * @brief Microsoft RTP/ASF support
25
 * @author Ronald S. Bultje <rbultje@ronald.bitfreak.net>
26
 */
27
28
#include "libavutil/base64.h"
29
#include "libavutil/avstring.h"
30
#include "libavutil/intreadwrite.h"
31
#include "libavutil/mem.h"
32
#include "rtpdec_formats.h"
33
#include "rtsp.h"
34
#include "asf.h"
35
#include "avio_internal.h"
36
#include "demux.h"
37
#include "internal.h"
38
39
/**
40
 * From MSDN 2.2.1.4, we learn that ASF data packets over RTP should not
41
 * contain any padding. Unfortunately, the header min/max_pktsize are not
42
 * updated (thus making min_pktsize invalid). Here, we "fix" these faulty
43
 * min_pktsize values in the ASF file header.
44
 * @return 0 on success, <0 on failure (currently -1).
45
 */
46
static int rtp_asf_fix_header(uint8_t *buf, int len)
47
0
{
48
0
    uint8_t *p = buf, *end = buf + len;
49
50
0
    if (len < sizeof(ff_asf_guid) * 2 + 22 ||
51
0
        memcmp(p, ff_asf_header, sizeof(ff_asf_guid))) {
52
0
        return -1;
53
0
    }
54
0
    p += sizeof(ff_asf_guid) + 14;
55
0
    do {
56
0
        uint64_t chunksize = AV_RL64(p + sizeof(ff_asf_guid));
57
0
        int skip = 6 * 8 + 3 * 4 + sizeof(ff_asf_guid) * 2;
58
0
        if (memcmp(p, ff_asf_file_header, sizeof(ff_asf_guid))) {
59
0
            if (chunksize > end - p)
60
0
                return -1;
61
0
            p += chunksize;
62
0
            continue;
63
0
        }
64
65
0
        if (end - p < 8 + skip)
66
0
            break;
67
        /* skip most of the file header, to min_pktsize */
68
0
        p += skip;
69
0
        if (AV_RL32(p) == AV_RL32(p + 4)) {
70
            /* and set that to zero */
71
0
            AV_WL32(p, 0);
72
0
            return 0;
73
0
        }
74
0
        break;
75
0
    } while (end - p >= sizeof(ff_asf_guid) + 8);
76
77
0
    return -1;
78
0
}
79
80
/**
81
 * The following code is basically a buffered AVIOContext,
82
 * with the added benefit of returning -EAGAIN (instead of 0)
83
 * on packet boundaries, such that the ASF demuxer can return
84
 * safely and resume business at the next packet.
85
 */
86
static int packetizer_read(void *opaque, uint8_t *buf, int buf_size)
87
0
{
88
0
    return AVERROR(EAGAIN);
89
0
}
90
91
static void init_packetizer(FFIOContext *pb, uint8_t *buf, int len)
92
0
{
93
0
    ffio_init_context(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);
94
95
    /* this "fills" the buffer with its current content */
96
0
    pb->pub.pos     = len;
97
0
    pb->pub.buf_end = buf + len;
98
0
}
99
100
int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
101
0
{
102
0
    int ret = 0;
103
0
    if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
104
0
        FFIOContext pb;
105
0
        RTSPState *rt = s->priv_data;
106
0
        AVDictionary *opts = NULL;
107
0
        int len = strlen(p) * 6 / 8;
108
0
        char *buf = av_mallocz(len);
109
0
        const AVInputFormat *iformat;
110
111
0
        if (!buf)
112
0
            return AVERROR(ENOMEM);
113
0
        av_base64_decode(buf, p, len);
114
115
0
        if (rtp_asf_fix_header(buf, len) < 0)
116
0
            av_log(s, AV_LOG_ERROR,
117
0
                   "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
118
0
        init_packetizer(&pb, buf, len);
119
0
        if (rt->asf_ctx) {
120
0
            avformat_close_input(&rt->asf_ctx);
121
0
        }
122
123
0
        if (!(iformat = av_find_input_format("asf"))) {
124
0
            av_free(buf);
125
0
            return AVERROR_DEMUXER_NOT_FOUND;
126
0
        }
127
128
0
        rt->asf_ctx = avformat_alloc_context();
129
0
        if (!rt->asf_ctx) {
130
0
            av_free(buf);
131
0
            return AVERROR(ENOMEM);
132
0
        }
133
0
        rt->asf_ctx->pb      = &pb.pub;
134
0
        av_dict_set(&opts, "no_resync_search", "1", 0);
135
136
0
        if ((ret = ff_copy_whiteblacklists(rt->asf_ctx, s)) < 0) {
137
0
            av_dict_free(&opts);
138
0
            return ret;
139
0
        }
140
141
0
        ret = avformat_open_input(&rt->asf_ctx, "", iformat, &opts);
142
0
        av_dict_free(&opts);
143
0
        if (ret < 0) {
144
0
            av_free(pb.pub.buffer);
145
0
            return ret;
146
0
        }
147
0
        av_dict_copy(&s->metadata, rt->asf_ctx->metadata, 0);
148
0
        rt->asf_pb_pos = avio_tell(&pb.pub);
149
0
        av_free(pb.pub.buffer);
150
0
        rt->asf_ctx->pb = NULL;
151
0
    }
152
0
    return ret;
153
0
}
154
155
static int asfrtp_parse_sdp_line(AVFormatContext *s, int stream_index,
156
                                 PayloadContext *asf, const char *line)
157
0
{
158
0
    if (stream_index < 0)
159
0
        return 0;
160
0
    if (av_strstart(line, "stream:", &line)) {
161
0
        RTSPState *rt = s->priv_data;
162
163
0
        s->streams[stream_index]->id = strtol(line, NULL, 10);
164
165
0
        if (rt->asf_ctx) {
166
0
            int i;
167
168
0
            for (i = 0; i < rt->asf_ctx->nb_streams; i++) {
169
0
                if (s->streams[stream_index]->id == rt->asf_ctx->streams[i]->id) {
170
0
                    avcodec_parameters_copy(s->streams[stream_index]->codecpar,
171
0
                                            rt->asf_ctx->streams[i]->codecpar);
172
0
                    ffstream(s->streams[stream_index])->need_parsing =
173
0
                        ffstream(rt->asf_ctx->streams[i])->need_parsing;
174
0
                    avpriv_set_pts_info(s->streams[stream_index], 32, 1, 1000);
175
0
                }
176
0
           }
177
0
        }
178
0
    }
179
180
0
    return 0;
181
0
}
182
183
struct PayloadContext {
184
    FFIOContext pb;
185
    AVIOContext *pktbuf;
186
    uint8_t *buf;
187
};
188
189
/**
190
 * @return 0 when a packet was written into /p pkt, and no more data is left;
191
 *         1 when a packet was written into /p pkt, and more packets might be left;
192
 *        <0 when not enough data was provided to return a full packet, or on error.
193
 */
194
static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
195
                               AVStream *st, AVPacket *pkt,
196
                               uint32_t *timestamp,
197
                               const uint8_t *buf, int len, uint16_t seq,
198
                               int flags)
199
0
{
200
0
    FFIOContext *const pb0 = &asf->pb;
201
0
    AVIOContext *const pb  = &pb0->pub;
202
0
    int res, mflags, len_off;
203
0
    RTSPState *rt = s->priv_data;
204
205
0
    if (!rt->asf_ctx)
206
0
        return -1;
207
208
0
    if (len > 0) {
209
0
        int off, out_len = 0;
210
211
0
        if (len < 4)
212
0
            return -1;
213
214
0
        av_freep(&asf->buf);
215
216
0
        ffio_init_read_context(pb0, buf, len);
217
218
0
        while (avio_tell(pb) + 4 < len) {
219
0
            int start_off = avio_tell(pb);
220
221
0
            mflags = avio_r8(pb);
222
0
            len_off = avio_rb24(pb);
223
0
            if (mflags & 0x20)   /**< relative timestamp */
224
0
                avio_skip(pb, 4);
225
0
            if (mflags & 0x10)   /**< has duration */
226
0
                avio_skip(pb, 4);
227
0
            if (mflags & 0x8)    /**< has location ID */
228
0
                avio_skip(pb, 4);
229
0
            off = avio_tell(pb);
230
231
0
            if (!(mflags & 0x40)) {
232
                /**
233
                 * If 0x40 is not set, the len_off field specifies an offset
234
                 * of this packet's payload data in the complete (reassembled)
235
                 * ASF packet. This is used to spread one ASF packet over
236
                 * multiple RTP packets.
237
                 */
238
0
                if (asf->pktbuf && len_off != avio_tell(asf->pktbuf)) {
239
0
                    ffio_free_dyn_buf(&asf->pktbuf);
240
0
                }
241
0
                if (!len_off && !asf->pktbuf &&
242
0
                    (res = avio_open_dyn_buf(&asf->pktbuf)) < 0)
243
0
                    return res;
244
0
                if (!asf->pktbuf)
245
0
                    return AVERROR(EIO);
246
247
0
                avio_write(asf->pktbuf, buf + off, len - off);
248
0
                avio_skip(pb, len - off);
249
0
                if (!(flags & RTP_FLAG_MARKER))
250
0
                    return -1;
251
0
                out_len     = avio_close_dyn_buf(asf->pktbuf, &asf->buf);
252
0
                asf->pktbuf = NULL;
253
0
            } else {
254
                /**
255
                 * If 0x40 is set, the len_off field specifies the length of
256
                 * the next ASF packet that can be read from this payload
257
                 * data alone. This is commonly the same as the payload size,
258
                 * but could be less in case of packet splitting (i.e.
259
                 * multiple ASF packets in one RTP packet).
260
                 */
261
262
0
                int cur_len = start_off + len_off - off;
263
0
                int prev_len = out_len;
264
0
                out_len += cur_len;
265
0
                if (FFMIN(cur_len, len - off) < 0)
266
0
                    return -1;
267
0
                if ((res = av_reallocp(&asf->buf, out_len)) < 0)
268
0
                    return res;
269
0
                memcpy(asf->buf + prev_len, buf + off,
270
0
                       FFMIN(cur_len, len - off));
271
0
                avio_skip(pb, cur_len);
272
0
            }
273
0
        }
274
275
0
        init_packetizer(pb0, asf->buf, out_len);
276
0
        pb->pos += rt->asf_pb_pos;
277
0
        pb->eof_reached = 0;
278
0
        rt->asf_ctx->pb = pb;
279
0
    }
280
281
0
    for (;;) {
282
0
        int i;
283
284
0
        res = ff_read_packet(rt->asf_ctx, pkt);
285
0
        rt->asf_pb_pos = avio_tell(pb);
286
0
        if (res != 0)
287
0
            break;
288
0
        for (i = 0; i < s->nb_streams; i++) {
289
0
            if (s->streams[i]->id == rt->asf_ctx->streams[pkt->stream_index]->id) {
290
0
                pkt->stream_index = i;
291
0
                return 1; // FIXME: return 0 if last packet
292
0
            }
293
0
        }
294
0
        av_packet_unref(pkt);
295
0
    }
296
297
0
    return res == 1 ? -1 : res;
298
0
}
299
300
static void asfrtp_close_context(PayloadContext *asf)
301
0
{
302
0
    ffio_free_dyn_buf(&asf->pktbuf);
303
0
    av_freep(&asf->buf);
304
0
}
305
306
#define RTP_ASF_HANDLER(n, s, t) \
307
const RTPDynamicProtocolHandler ff_ms_rtp_ ## n ## _handler = { \
308
    .enc_name         = s, \
309
    .codec_type       = t, \
310
    .codec_id         = AV_CODEC_ID_NONE, \
311
    .priv_data_size   = sizeof(PayloadContext), \
312
    .parse_sdp_a_line = asfrtp_parse_sdp_line, \
313
    .close            = asfrtp_close_context, \
314
    .parse_packet     = asfrtp_parse_packet,   \
315
}
316
317
RTP_ASF_HANDLER(asf_pfv, "x-asf-pf",  AVMEDIA_TYPE_VIDEO);
318
RTP_ASF_HANDLER(asf_pfa, "x-asf-pf",  AVMEDIA_TYPE_AUDIO);