Coverage Report

Created: 2026-01-16 07:48

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavformat/mpc8.c
Line
Count
Source
1
/*
2
 * Musepack SV8 demuxer
3
 * Copyright (c) 2007 Konstantin Shishkov
4
 *
5
 * This file is part of FFmpeg.
6
 *
7
 * FFmpeg is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * FFmpeg is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with FFmpeg; if not, write to the Free Software
19
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20
 */
21
22
#include "libavutil/mem.h"
23
#include "libavcodec/get_bits.h"
24
#include "libavcodec/unary.h"
25
#include "apetag.h"
26
#include "avformat.h"
27
#include "demux.h"
28
#include "internal.h"
29
#include "avio_internal.h"
30
31
/// Two-byte MPC tag
32
#define MKMPCTAG(a, b) ((a) | ((b) << 8))
33
34
813k
#define TAG_MPCK MKTAG('M','P','C','K')
35
36
/// Reserved MPC tags
37
enum MPCPacketTags{
38
    TAG_STREAMHDR   = MKMPCTAG('S','H'),
39
    TAG_STREAMEND   = MKMPCTAG('S','E'),
40
41
    TAG_AUDIOPACKET = MKMPCTAG('A','P'),
42
43
    TAG_SEEKTBLOFF  = MKMPCTAG('S','O'),
44
    TAG_SEEKTABLE   = MKMPCTAG('S','T'),
45
46
    TAG_REPLAYGAIN  = MKMPCTAG('R','G'),
47
    TAG_ENCINFO     = MKMPCTAG('E','I'),
48
};
49
50
static const int mpc8_rate[8] = { 44100, 48000, 37800, 32000, -1, -1, -1, -1 };
51
52
typedef struct MPCContext {
53
    int ver;
54
    int64_t header_pos;
55
    int64_t samples;
56
57
    int64_t apetag_start;
58
} MPCContext;
59
60
static inline int64_t bs_get_v(const uint8_t **bs)
61
7.78k
{
62
7.78k
    uint64_t v = 0;
63
7.78k
    int br = 0;
64
7.78k
    int c;
65
66
19.3k
    do {
67
19.3k
        c = **bs; (*bs)++;
68
19.3k
        v <<= 7;
69
19.3k
        v |= c & 0x7F;
70
19.3k
        br++;
71
19.3k
        if (br > 10)
72
273
            return -1;
73
19.3k
    } while (c & 0x80);
74
75
7.51k
    return v - br;
76
7.78k
}
77
78
static int mpc8_probe(const AVProbeData *p)
79
958k
{
80
958k
    const uint8_t *bs = p->buf + 4;
81
958k
    const uint8_t *bs_end = bs + p->buf_size;
82
958k
    int64_t size;
83
84
958k
    if (p->buf_size < 16)
85
149k
        return 0;
86
808k
    if (AV_RL32(p->buf) != TAG_MPCK)
87
804k
        return 0;
88
8.74k
    while (bs < bs_end + 3) {
89
8.74k
        int header_found = (bs[0] == 'S' && bs[1] == 'H');
90
8.74k
        if (bs[0] < 'A' || bs[0] > 'Z' || bs[1] < 'A' || bs[1] > 'Z')
91
959
            return 0;
92
7.78k
        bs += 2;
93
7.78k
        size = bs_get_v(&bs);
94
7.78k
        if (size < 2)
95
578
            return 0;
96
7.20k
        if (size >= bs_end - bs + 2)
97
1.76k
            return AVPROBE_SCORE_EXTENSION - 1; // seems to be valid MPC but no header yet
98
5.44k
        if (header_found) {
99
875
            if (size < 11 || size > 28)
100
208
                return 0;
101
667
            if (!AV_RL32(bs)) //zero CRC is invalid
102
99
                return 0;
103
568
            return AVPROBE_SCORE_MAX;
104
4.56k
        } else {
105
4.56k
            bs += size - 2;
106
4.56k
        }
107
5.44k
    }
108
0
    return 0;
109
4.17k
}
110
111
static inline int64_t gb_get_v(GetBitContext *gb)
112
13.1k
{
113
13.1k
    uint64_t v = 0;
114
13.1k
    int bits = 0;
115
21.7k
    while(get_bits1(gb) && bits < 64-7){
116
8.62k
        v <<= 7;
117
8.62k
        v |= get_bits(gb, 7);
118
8.62k
        bits += 7;
119
8.62k
    }
120
13.1k
    v <<= 7;
121
13.1k
    v |= get_bits(gb, 7);
122
123
13.1k
    return v;
124
13.1k
}
125
126
static void mpc8_get_chunk_header(AVIOContext *pb, int *tag, int64_t *size)
127
588k
{
128
588k
    int64_t pos;
129
588k
    pos = avio_tell(pb);
130
588k
    *tag = avio_rl16(pb);
131
588k
    *size = ffio_read_varlen(pb);
132
588k
    pos -= avio_tell(pb);
133
588k
    if (av_sat_add64(*size, pos) != (uint64_t)*size + pos) {
134
304
        *size = -1;
135
304
    } else
136
587k
        *size += pos;
137
588k
}
138
139
static int mpc8_parse_seektable(AVFormatContext *s, int64_t off)
140
10.6k
{
141
10.6k
    MPCContext *c = s->priv_data;
142
10.6k
    int tag;
143
10.6k
    int64_t size, pos, ppos[2];
144
10.6k
    uint8_t *buf;
145
10.6k
    int i, t, seekd, ret;
146
10.6k
    int64_t ret64;
147
10.6k
    GetBitContext gb;
148
149
10.6k
    if (s->nb_streams == 0) {
150
126
        av_log(s, AV_LOG_ERROR, "No stream added before parsing seek table\n");
151
126
        return AVERROR_INVALIDDATA;
152
126
    }
153
154
10.5k
    ret64 = avio_seek(s->pb, off, SEEK_SET);
155
10.5k
    if (ret64 < 0)
156
899
        return AVERROR_INVALIDDATA;
157
9.66k
    mpc8_get_chunk_header(s->pb, &tag, &size);
158
9.66k
    if(tag != TAG_SEEKTABLE || avio_feof(s->pb)){
159
2.88k
        av_log(s, AV_LOG_ERROR, "No seek table at given position\n");
160
2.88k
        return AVERROR_INVALIDDATA;
161
2.88k
    }
162
6.77k
    if (size > INT_MAX/10 || size<=0) {
163
913
        av_log(s, AV_LOG_ERROR, "Bad seek table size\n");
164
913
        return AVERROR_INVALIDDATA;
165
913
    }
166
5.86k
    if(!(buf = av_malloc(size + AV_INPUT_BUFFER_PADDING_SIZE)))
167
0
        return AVERROR(ENOMEM);
168
5.86k
    ret = avio_read(s->pb, buf, size);
169
5.86k
    if (ret != size) {
170
131
        av_log(s, AV_LOG_ERROR, "seek table truncated\n");
171
131
        av_free(buf);
172
131
        return AVERROR_INVALIDDATA;
173
131
    }
174
5.73k
    memset(buf+size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
175
176
5.73k
    init_get_bits(&gb, buf, size * 8);
177
5.73k
    size = gb_get_v(&gb);
178
5.73k
    if(size > UINT_MAX/4 || size > c->samples/1152){
179
2.05k
        av_log(s, AV_LOG_ERROR, "Seek table is too big\n");
180
2.05k
        av_free(buf);
181
2.05k
        return AVERROR_INVALIDDATA;
182
2.05k
    }
183
3.68k
    seekd = get_bits(&gb, 4);
184
11.0k
    for(i = 0; i < 2; i++){
185
7.36k
        pos = gb_get_v(&gb);
186
7.36k
        if (av_sat_add64(pos, c->header_pos) != pos + (uint64_t)c->header_pos) {
187
0
            av_free(buf);
188
0
            return AVERROR_INVALIDDATA;
189
0
        }
190
191
7.36k
        pos += c->header_pos;
192
7.36k
        ppos[1 - i] = pos;
193
7.36k
        av_add_index_entry(s->streams[0], pos, i, 0, 0, AVINDEX_KEYFRAME);
194
7.36k
    }
195
488k
    for(; i < size; i++){
196
486k
        if (get_bits_left(&gb) < 13) {
197
1.91k
            av_free(buf);
198
1.91k
            return AVERROR_INVALIDDATA;
199
1.91k
        }
200
484k
        t = get_unary(&gb, 1, 33) << 12;
201
484k
        t += get_bits(&gb, 12);
202
484k
        if(t & 1)
203
267k
            t = -(t & ~1);
204
484k
        pos = (t >> 1) + (uint64_t)ppos[0]*2 - ppos[1];
205
484k
        av_add_index_entry(s->streams[0], pos, (int64_t)i << seekd, 0, 0, AVINDEX_KEYFRAME);
206
484k
        ppos[1] = ppos[0];
207
484k
        ppos[0] = pos;
208
484k
    }
209
1.76k
    av_free(buf);
210
1.76k
    return 0;
211
3.68k
}
212
213
static int mpc8_handle_chunk(AVFormatContext *s, int tag, int64_t chunk_pos, int64_t size)
214
106k
{
215
106k
    AVIOContext *pb = s->pb;
216
106k
    int64_t pos, off;
217
106k
    int ret;
218
219
106k
    switch(tag){
220
12.2k
    case TAG_SEEKTBLOFF:
221
12.2k
        pos = avio_tell(pb);
222
12.2k
        off = ffio_read_varlen(pb);
223
12.2k
        if (pos > INT64_MAX - size || off < 0 || off > INT64_MAX - chunk_pos)
224
1.59k
            return AVERROR_INVALIDDATA;
225
10.6k
        pos += size;
226
10.6k
        ret = mpc8_parse_seektable(s, chunk_pos + off);
227
10.6k
        if (ret < 0)
228
8.92k
            return AVERROR_INVALIDDATA;
229
1.76k
        avio_seek(pb, pos, SEEK_SET);
230
1.76k
        break;
231
94.6k
    default:
232
94.6k
        avio_skip(pb, size);
233
106k
    }
234
96.4k
    return 0;
235
106k
}
236
237
static int mpc8_read_header(AVFormatContext *s)
238
5.07k
{
239
5.07k
    MPCContext *c = s->priv_data;
240
5.07k
    AVIOContext *pb = s->pb;
241
5.07k
    AVStream *st;
242
5.07k
    int tag = 0, ret;
243
5.07k
    int channels;
244
5.07k
    int64_t size, pos;
245
246
5.07k
    c->header_pos = avio_tell(pb);
247
5.07k
    if(avio_rl32(pb) != TAG_MPCK){
248
162
        av_log(s, AV_LOG_ERROR, "Not a Musepack8 file\n");
249
162
        return AVERROR_INVALIDDATA;
250
162
    }
251
252
8.53k
    while(!avio_feof(pb)){
253
8.24k
        pos = avio_tell(pb);
254
8.24k
        mpc8_get_chunk_header(pb, &tag, &size);
255
8.24k
        if (size < 0) {
256
132
            av_log(s, AV_LOG_ERROR, "Invalid chunk length\n");
257
132
            return AVERROR_INVALIDDATA;
258
132
        }
259
8.11k
        if(tag == TAG_STREAMHDR)
260
4.21k
            break;
261
3.90k
        ret = mpc8_handle_chunk(s, tag, pos, size);
262
3.90k
        if (ret < 0)
263
286
            return ret;
264
3.90k
    }
265
4.49k
    if(tag != TAG_STREAMHDR){
266
288
        av_log(s, AV_LOG_ERROR, "Stream header not found\n");
267
288
        return AVERROR_INVALIDDATA;
268
288
    }
269
4.21k
    pos = avio_tell(pb);
270
4.21k
    avio_skip(pb, 4); //CRC
271
4.21k
    c->ver = avio_r8(pb);
272
4.21k
    if(c->ver != 8){
273
16
        avpriv_report_missing_feature(s, "Stream version %d", c->ver);
274
16
        return AVERROR_PATCHWELCOME;
275
16
    }
276
4.19k
    c->samples = ffio_read_varlen(pb);
277
4.19k
    ffio_read_varlen(pb); //silence samples at the beginning
278
279
4.19k
    st = avformat_new_stream(s, NULL);
280
4.19k
    if (!st)
281
0
        return AVERROR(ENOMEM);
282
4.19k
    st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
283
4.19k
    st->codecpar->codec_id = AV_CODEC_ID_MUSEPACK8;
284
4.19k
    st->codecpar->bits_per_coded_sample = 16;
285
286
4.19k
    if ((ret = ff_get_extradata(s, st->codecpar, pb, 2)) < 0)
287
8
        return ret;
288
289
4.18k
    channels = (st->codecpar->extradata[1] >> 4) + 1;
290
4.18k
    st->codecpar->ch_layout.nb_channels = channels;
291
4.18k
    st->codecpar->sample_rate = mpc8_rate[st->codecpar->extradata[0] >> 5];
292
4.18k
    avpriv_set_pts_info(st, 64, 1152  << (st->codecpar->extradata[1]&3)*2, st->codecpar->sample_rate);
293
4.18k
    st->start_time = 0;
294
4.18k
    st->duration = c->samples / (1152 << (st->codecpar->extradata[1]&3)*2);
295
4.18k
    size -= avio_tell(pb) - pos;
296
4.18k
    if (size > 0)
297
1.20k
        avio_skip(pb, size);
298
299
4.18k
    if (pb->seekable & AVIO_SEEKABLE_NORMAL) {
300
2.08k
        int64_t pos = avio_tell(s->pb);
301
2.08k
        c->apetag_start = ff_ape_parse_tag(s);
302
2.08k
        avio_seek(s->pb, pos, SEEK_SET);
303
2.08k
    }
304
305
4.18k
    return 0;
306
4.19k
}
307
308
static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt)
309
473k
{
310
473k
    MPCContext *c = s->priv_data;
311
473k
    int tag, ret;
312
473k
    int64_t pos, size;
313
314
576k
    while(!avio_feof(s->pb)){
315
570k
        pos = avio_tell(s->pb);
316
317
        /* don't return bogus packets with the ape tag data */
318
570k
        if (c->apetag_start && pos >= c->apetag_start)
319
204
            return AVERROR_EOF;
320
321
570k
        mpc8_get_chunk_header(s->pb, &tag, &size);
322
570k
        if (size < 0 || size > INT_MAX)
323
1.08k
            return -1;
324
569k
        if(tag == TAG_AUDIOPACKET){
325
466k
            if ((ret = av_get_packet(s->pb, pkt, size)) < 0)
326
258
                return ret;
327
465k
            pkt->stream_index = 0;
328
465k
            pkt->duration     = 1;
329
465k
            return 0;
330
466k
        }
331
103k
        if(tag == TAG_STREAMEND)
332
7
            return AVERROR_EOF;
333
103k
        mpc8_handle_chunk(s, tag, pos, size);
334
103k
    }
335
6.44k
    return AVERROR_EOF;
336
473k
}
337
338
static int mpc8_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags)
339
0
{
340
0
    AVStream *st = s->streams[stream_index];
341
0
    FFStream *const sti = ffstream(st);
342
0
    int index = av_index_search_timestamp(st, timestamp, flags);
343
344
0
    if(index < 0) return -1;
345
0
    if (avio_seek(s->pb, sti->index_entries[index].pos, SEEK_SET) < 0)
346
0
        return -1;
347
0
    avpriv_update_cur_dts(s, st, sti->index_entries[index].timestamp);
348
0
    return 0;
349
0
}
350
351
352
const FFInputFormat ff_mpc8_demuxer = {
353
    .p.name         = "mpc8",
354
    .p.long_name    = NULL_IF_CONFIG_SMALL("Musepack SV8"),
355
    .priv_data_size = sizeof(MPCContext),
356
    .read_probe     = mpc8_probe,
357
    .read_header    = mpc8_read_header,
358
    .read_packet    = mpc8_read_packet,
359
    .read_seek      = mpc8_read_seek,
360
};