Coverage Report

Created: 2026-01-16 07:48

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavformat/aaxdec.c
Line
Count
Source
1
/*
2
 * AAX demuxer
3
 * Copyright (c) 2020 Paul B Mahol
4
 *
5
 * This file is part of FFmpeg.
6
 *
7
 * FFmpeg is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * FFmpeg is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with FFmpeg; if not, write to the Free Software
19
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20
 */
21
22
#include "libavutil/intreadwrite.h"
23
#include "libavutil/mem.h"
24
#include "avformat.h"
25
#include "avio_internal.h"
26
#include "demux.h"
27
#include "internal.h"
28
29
typedef struct AAXColumn {
30
    uint8_t flag;
31
    uint8_t type;
32
    const char *name;
33
    uint32_t offset;
34
    int size;
35
} AAXColumn;
36
37
typedef struct AAXSegment {
38
    int64_t start;
39
    int64_t end;
40
} AAXSegment;
41
42
typedef struct AAXContext {
43
    int64_t table_size;
44
    uint16_t version;
45
    int64_t rows_offset;
46
    int64_t strings_offset;
47
    int64_t data_offset;
48
    int64_t name_offset;
49
    uint16_t columns;
50
    uint16_t row_width;
51
    uint32_t nb_segments;
52
    int64_t schema_offset;
53
    int64_t strings_size;
54
    char *string_table;
55
56
    uint32_t current_segment;
57
58
    AAXColumn *xcolumns;
59
    AAXSegment *segments;
60
} AAXContext;
61
62
static int aax_probe(const AVProbeData *p)
63
958k
{
64
958k
    if (AV_RB32(p->buf) != MKBETAG('@','U','T','F'))
65
957k
        return 0;
66
916
    if (AV_RB32(p->buf + 4) == 0)
67
200
        return 0;
68
716
    if (AV_RB16(p->buf + 8) > 1)
69
288
        return 0;
70
428
    if (AV_RB32(p->buf + 28) < 1)
71
181
        return 0;
72
73
247
    return AVPROBE_SCORE_MAX;
74
428
}
75
76
enum ColumnFlag {
77
    COLUMN_FLAG_NAME            = 0x1,
78
    COLUMN_FLAG_DEFAULT         = 0x2,
79
    COLUMN_FLAG_ROW             = 0x4,
80
    COLUMN_FLAG_UNDEFINED       = 0x8 /* shouldn't exist */
81
};
82
83
enum ColumnType {
84
    COLUMN_TYPE_UINT8           = 0x00,
85
    COLUMN_TYPE_SINT8           = 0x01,
86
    COLUMN_TYPE_UINT16          = 0x02,
87
    COLUMN_TYPE_SINT16          = 0x03,
88
    COLUMN_TYPE_UINT32          = 0x04,
89
    COLUMN_TYPE_SINT32          = 0x05,
90
    COLUMN_TYPE_UINT64          = 0x06,
91
    COLUMN_TYPE_SINT64          = 0x07,
92
    COLUMN_TYPE_FLOAT           = 0x08,
93
    COLUMN_TYPE_DOUBLE          = 0x09,
94
    COLUMN_TYPE_STRING          = 0x0a,
95
    COLUMN_TYPE_VLDATA          = 0x0b,
96
    COLUMN_TYPE_UINT128         = 0x0c, /* for GUIDs */
97
    COLUMN_TYPE_UNDEFINED       = -1
98
};
99
100
static int64_t get_pts(AVFormatContext *s, int64_t pos, int size)
101
188k
{
102
188k
    AAXContext *a = s->priv_data;
103
188k
    int64_t pts = 0;
104
105
188k
    for (int seg = 0; seg < a->current_segment; seg++)
106
0
        pts += (a->segments[seg].end - a->segments[seg].start) / size;
107
108
188k
    pts += ((pos - a->segments[a->current_segment].start) / size);
109
110
188k
    return pts;
111
188k
}
112
113
static int aax_read_header(AVFormatContext *s)
114
1.24k
{
115
1.24k
    AAXContext *a = s->priv_data;
116
1.24k
    AVIOContext *pb = s->pb;
117
1.24k
    AVCodecParameters *par;
118
1.24k
    AVStream *st;
119
1.24k
    int64_t column_offset = 0;
120
1.24k
    int ret, extradata_size;
121
1.24k
    char *codec;
122
1.24k
    int64_t ret64;
123
124
1.24k
    avio_skip(pb, 4);
125
1.24k
    a->table_size      = avio_rb32(pb) + 8LL;
126
1.24k
    a->version         = avio_rb16(pb);
127
1.24k
    a->rows_offset     = avio_rb16(pb) + 8LL;
128
1.24k
    a->strings_offset  = avio_rb32(pb) + 8LL;
129
1.24k
    a->data_offset     = avio_rb32(pb) + 8LL;
130
1.24k
    a->name_offset     = avio_rb32(pb);
131
1.24k
    a->columns         = avio_rb16(pb);
132
1.24k
    a->row_width       = avio_rb16(pb);
133
1.24k
    a->nb_segments     = avio_rb32(pb);
134
135
1.24k
    if (a->nb_segments < 1)
136
122
        return AVERROR_INVALIDDATA;
137
138
1.12k
    a->schema_offset   = 0x20;
139
1.12k
    a->strings_size    = a->data_offset - a->strings_offset;
140
141
1.12k
    if (a->rows_offset > a->table_size ||
142
1.12k
        a->strings_offset > a->table_size ||
143
1.10k
        a->data_offset > a->table_size)
144
28
        return AVERROR_INVALIDDATA;
145
1.09k
    if (a->strings_size <= 0 || a->name_offset >= a->strings_size ||
146
1.07k
        a->strings_size > UINT16_MAX)
147
22
        return AVERROR_INVALIDDATA;
148
1.07k
    if (a->columns <= 0)
149
2
        return AVERROR_INVALIDDATA;
150
151
1.07k
    a->segments = av_calloc(a->nb_segments, sizeof(*a->segments));
152
1.07k
    if (!a->segments)
153
2
        return AVERROR(ENOMEM);
154
155
1.07k
    a->xcolumns = av_calloc(a->columns, sizeof(*a->xcolumns));
156
1.07k
    if (!a->xcolumns)
157
0
        return AVERROR(ENOMEM);
158
159
1.07k
    a->string_table = av_calloc(a->strings_size + 1, sizeof(*a->string_table));
160
1.07k
    if (!a->string_table)
161
0
        return AVERROR(ENOMEM);
162
163
993k
    for (int c = 0; c < a->columns; c++) {
164
992k
        uint8_t info = avio_r8(pb);
165
992k
        uint32_t offset = avio_rb32(pb);
166
992k
        int value_size;
167
168
992k
        if (offset >= a->strings_size)
169
19
            return AVERROR_INVALIDDATA;
170
171
992k
        a->xcolumns[c].flag = info >>   4;
172
992k
        a->xcolumns[c].type = info & 0x0F;
173
174
992k
        switch (a->xcolumns[c].type) {
175
989k
        case COLUMN_TYPE_UINT8:
176
989k
        case COLUMN_TYPE_SINT8:
177
989k
            value_size = 0x01;
178
989k
            break;
179
72
        case COLUMN_TYPE_UINT16:
180
1.09k
        case COLUMN_TYPE_SINT16:
181
1.09k
            value_size = 0x02;
182
1.09k
            break;
183
15
        case COLUMN_TYPE_UINT32:
184
24
        case COLUMN_TYPE_SINT32:
185
34
        case COLUMN_TYPE_FLOAT:
186
38
        case COLUMN_TYPE_STRING:
187
38
            value_size = 0x04;
188
38
            break;
189
1.18k
        case COLUMN_TYPE_VLDATA:
190
1.18k
            value_size = 0x08;
191
1.18k
            break;
192
255
        case COLUMN_TYPE_UINT128:
193
255
            value_size = 0x10;
194
255
            break;
195
0
        default:
196
0
            return AVERROR_INVALIDDATA;
197
992k
        }
198
199
992k
        a->xcolumns[c].size = value_size;
200
201
992k
        if (a->xcolumns[c].flag & COLUMN_FLAG_NAME)
202
3.81k
            a->xcolumns[c].name = a->string_table + offset;
203
204
992k
        if (a->xcolumns[c].flag & COLUMN_FLAG_DEFAULT) {
205
            /* data is found relative to columns start */
206
3.00k
            a->xcolumns[c].offset = avio_tell(pb) - a->schema_offset;
207
3.00k
            avio_skip(pb, value_size);
208
3.00k
        }
209
210
992k
        if (a->xcolumns[c].flag & COLUMN_FLAG_ROW) {
211
            /* data is found relative to row start */
212
3.60k
            a->xcolumns[c].offset = column_offset;
213
3.60k
            column_offset += value_size;
214
3.60k
        }
215
992k
    }
216
217
1.05k
    ret = ret64 = avio_seek(pb, a->strings_offset, SEEK_SET);
218
1.05k
    if (ret64 < 0)
219
47
        return ret;
220
221
1.00k
    ret = ffio_read_size(pb, a->string_table, a->strings_size);
222
1.00k
    if (ret < 0)
223
122
        return ret;
224
225
85.9k
    for (int c = 0; c < a->columns; c++) {
226
85.1k
        int64_t data_offset = 0;
227
85.1k
        int64_t col_offset;
228
85.1k
        int flag, type;
229
230
85.1k
        if (!a->xcolumns[c].name || strcmp(a->xcolumns[c].name, "data"))
231
84.2k
            continue;
232
233
945
        type = a->xcolumns[c].type;
234
945
        flag = a->xcolumns[c].flag;
235
945
        col_offset = a->xcolumns[c].offset;
236
237
3.46k
        for (uint64_t r = 0; r < a->nb_segments; r++) {
238
2.64k
            if (flag & COLUMN_FLAG_DEFAULT) {
239
1.52k
                data_offset = a->schema_offset + col_offset;
240
1.52k
            } else if (flag & COLUMN_FLAG_ROW) {
241
1.11k
                data_offset = a->rows_offset + r * a->row_width + col_offset;
242
1.11k
            } else
243
1
                return AVERROR_INVALIDDATA;
244
245
2.64k
            ret = ret64 = avio_seek(pb, data_offset, SEEK_SET);
246
2.64k
            if (ret64 < 0)
247
46
                return ret;
248
249
2.59k
            if (type == COLUMN_TYPE_VLDATA) {
250
2.59k
                int64_t start, size;
251
252
2.59k
                start = avio_rb32(pb);
253
2.59k
                size  = avio_rb32(pb);
254
2.59k
                if (!size)
255
43
                    return AVERROR_INVALIDDATA;
256
2.55k
                a->segments[r].start = start + a->data_offset;
257
2.55k
                a->segments[r].end   = a->segments[r].start + size;
258
2.55k
                if (r &&
259
1.64k
                    a->segments[r].start < a->segments[r-1].end &&
260
722
                    a->segments[r].end   > a->segments[r-1].start)
261
26
                    return AVERROR_INVALIDDATA;
262
2.55k
            } else
263
1
                return AVERROR_INVALIDDATA;
264
2.59k
        }
265
945
    }
266
267
767
    if (!a->segments[0].end)
268
16
        return AVERROR_INVALIDDATA;
269
270
751
    st = avformat_new_stream(s, NULL);
271
751
    if (!st)
272
0
        return AVERROR(ENOMEM);
273
751
    st->start_time = 0;
274
751
    par = s->streams[0]->codecpar;
275
751
    par->codec_type = AVMEDIA_TYPE_AUDIO;
276
277
751
    codec = a->string_table + a->name_offset;
278
751
    if (!strcmp(codec, "AAX")) {
279
712
        par->codec_id = AV_CODEC_ID_ADPCM_ADX;
280
712
        ret64 = avio_seek(pb, a->segments[0].start, SEEK_SET);
281
712
        if (ret64 < 0 || avio_rb16(pb) != 0x8000)
282
106
            return AVERROR_INVALIDDATA;
283
606
        extradata_size = avio_rb16(pb) + 4;
284
606
        if (extradata_size < 12)
285
4
            return AVERROR_INVALIDDATA;
286
602
        avio_seek(pb, -4, SEEK_CUR);
287
602
        ret = ff_get_extradata(s, par, pb, extradata_size);
288
602
        if (ret < 0)
289
40
            return ret;
290
562
        par->ch_layout.nb_channels = AV_RB8 (par->extradata + 7);
291
562
        par->sample_rate = AV_RB32(par->extradata + 8);
292
562
        if (!par->ch_layout.nb_channels || !par->sample_rate)
293
5
            return AVERROR_INVALIDDATA;
294
295
557
        avpriv_set_pts_info(st, 64, 32, par->sample_rate);
296
  /*} else if (!strcmp(codec, "HCA") ){
297
        par->codec_id = AV_CODEC_ID_HCA;*/
298
557
    } else {
299
39
        return AVERROR_INVALIDDATA;
300
39
    }
301
302
557
    return 0;
303
751
}
304
305
static int aax_read_packet(AVFormatContext *s, AVPacket *pkt)
306
189k
{
307
189k
    AAXContext *a = s->priv_data;
308
189k
    AVCodecParameters *par = s->streams[0]->codecpar;
309
189k
    AVIOContext *pb = s->pb;
310
189k
    const int size = 18 * par->ch_layout.nb_channels;
311
189k
    int ret, extradata_size = 0;
312
189k
    uint8_t *extradata = NULL;
313
189k
    int skip = 0;
314
315
189k
    if (avio_feof(pb))
316
156
        return AVERROR_EOF;
317
318
189k
    pkt->pos = avio_tell(pb);
319
320
189k
    for (uint32_t seg = 0; seg < a->nb_segments; seg++) {
321
189k
        int64_t start = a->segments[seg].start;
322
189k
        int64_t end   = a->segments[seg].end;
323
324
189k
        if (pkt->pos >= start && pkt->pos <= end) {
325
188k
            a->current_segment = seg;
326
188k
            if (par->codec_id == AV_CODEC_ID_ADPCM_ADX)
327
188k
                skip = (end - start) - ((end - start) / size) * size;
328
188k
            break;
329
188k
        }
330
189k
    }
331
332
189k
    if (pkt->pos >= a->segments[a->current_segment].end - skip) {
333
113
        if (a->current_segment + 1 == a->nb_segments)
334
113
            return AVERROR_EOF;
335
0
        a->current_segment++;
336
0
        avio_seek(pb, a->segments[a->current_segment].start, SEEK_SET);
337
338
0
        if (par->codec_id == AV_CODEC_ID_ADPCM_ADX) {
339
0
            if (avio_rb16(pb) != 0x8000)
340
0
                return AVERROR_INVALIDDATA;
341
0
            extradata_size = avio_rb16(pb) + 4;
342
0
            avio_seek(pb, -4, SEEK_CUR);
343
0
            if (extradata_size < 12)
344
0
                return AVERROR_INVALIDDATA;
345
0
            extradata = av_malloc(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
346
0
            if (!extradata)
347
0
                return AVERROR(ENOMEM);
348
0
            ret = ffio_read_size(pb, extradata, extradata_size);
349
0
            if (ret < 0) {
350
0
                av_free(extradata);
351
0
                return ret;
352
0
            }
353
0
            memset(extradata + extradata_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
354
0
        }
355
0
    }
356
357
188k
    ret = av_get_packet(pb, pkt, size);
358
188k
    if (ret != size) {
359
493
        av_free(extradata);
360
493
        return ret < 0 ? ret : AVERROR_INVALIDDATA;
361
493
    }
362
188k
    pkt->duration = 1;
363
188k
    pkt->stream_index = 0;
364
188k
    pkt->pts = get_pts(s, pkt->pos, size);
365
366
188k
    if (extradata) {
367
0
        ret = av_packet_add_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, extradata, extradata_size);
368
0
        if (ret < 0) {
369
0
            av_free(extradata);
370
0
            return ret;
371
0
        }
372
0
    }
373
374
188k
    return ret;
375
188k
}
376
377
static int aax_read_close(AVFormatContext *s)
378
1.24k
{
379
1.24k
    AAXContext *a = s->priv_data;
380
381
1.24k
    av_freep(&a->segments);
382
1.24k
    av_freep(&a->xcolumns);
383
1.24k
    av_freep(&a->string_table);
384
385
1.24k
    return 0;
386
1.24k
}
387
388
const FFInputFormat ff_aax_demuxer = {
389
    .p.name         = "aax",
390
    .p.long_name    = NULL_IF_CONFIG_SMALL("CRI AAX"),
391
    .p.extensions   = "aax",
392
    .p.flags        = AVFMT_GENERIC_INDEX,
393
    .priv_data_size = sizeof(AAXContext),
394
    .flags_internal = FF_INFMT_FLAG_INIT_CLEANUP,
395
    .read_probe     = aax_probe,
396
    .read_header    = aax_read_header,
397
    .read_packet    = aax_read_packet,
398
    .read_close     = aax_read_close,
399
};