/src/ffmpeg/libavformat/apngdec.c

Source
/*
 * APNG demuxer
 * Copyright (c) 2014 Benoit Fouet
 *
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

/**
 * @file
 * APNG demuxer.
 * @see https://wiki.mozilla.org/APNG_Specification
 * @see http://www.w3.org/TR/PNG
 */

#include "avformat.h"
#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
#include "libavutil/imgutils.h"
#include "libavutil/intreadwrite.h"
#include "libavutil/mem.h"
#include "libavutil/opt.h"
#include "libavcodec/apng.h"
#include "libavcodec/png.h"
#include "libavcodec/bytestream.h"

#define DEFAULT_APNG_FPS 15

typedef struct APNGDemuxContext {
    const AVClass *class;

    int max_fps;
    int default_fps;

    int pkt_duration;

    int is_key_frame;

    /*
     * loop options
     */
    int ignore_loop;
    uint32_t num_frames;
    uint32_t num_play;
    uint32_t cur_loop;
} APNGDemuxContext;

/*
 * To be a valid APNG file, we mandate, in this order:
 *     PNGSIG
 *     IHDR
 *     ...
 *     acTL
 *     ...
 *     IDAT
 */
static int apng_probe(const AVProbeData *p)
{
    GetByteContext gb;
    int state = 0;
    uint32_t len, tag;

    bytestream2_init(&gb, p->buf, p->buf_size);

    if (bytestream2_get_be64(&gb) != PNGSIG)
        return 0;

    for (;;) {
        len = bytestream2_get_be32(&gb);
        if (len > 0x7fffffff)
            return 0;

        tag = bytestream2_get_le32(&gb);
        /* we don't check IDAT size, as this is the last tag
         * we check, and it may be larger than the probe buffer */
        if (tag != MKTAG('I', 'D', 'A', 'T') &&
            len + 4 > bytestream2_get_bytes_left(&gb))
            return 0;

        switch (tag) {
        case MKTAG('I', 'H', 'D', 'R'):
            if (len != 13)
                return 0;
            if (av_image_check_size(bytestream2_get_be32(&gb), bytestream2_get_be32(&gb), 0, NULL))
                return 0;
            bytestream2_skip(&gb, 9);
            state++;
            break;
        case MKTAG('a', 'c', 'T', 'L'):
            if (state != 1 ||
                len != 8 ||
                bytestream2_get_be32(&gb) == 0) /* 0 is not a valid value for number of frames */
                return 0;
            bytestream2_skip(&gb, 8);
            state++;
            break;
        case MKTAG('I', 'D', 'A', 'T'):
            if (state != 2)
                return 0;
            goto end;
        default:
            /* skip other tags */
            bytestream2_skip(&gb, len + 4);
            break;
        }
    }

end:
    return AVPROBE_SCORE_MAX;
}

static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len)
{
    int previous_size = par->extradata_size;
    int new_size, ret;
    uint8_t *new_extradata;

    if (len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - previous_size)
        return AVERROR_INVALIDDATA;

    new_size = previous_size + len;
    new_extradata = av_realloc(par->extradata, new_size + AV_INPUT_BUFFER_PADDING_SIZE);
    if (!new_extradata)
        return AVERROR(ENOMEM);
    memset(new_extradata + new_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
    par->extradata = new_extradata;
    par->extradata_size = new_size;

    if ((ret = ffio_read_size(pb, par->extradata + previous_size, len)) < 0)
        return ret;

    return previous_size;
}

static int apng_read_header(AVFormatContext *s)
{
    APNGDemuxContext *ctx = s->priv_data;
    AVIOContext *pb = s->pb;
    uint32_t len, tag;
    AVStream *st;
    int acTL_found = 0;
    int64_t ret;

    /* verify PNGSIG */
    if (avio_rb64(pb) != PNGSIG)
        return AVERROR_INVALIDDATA;

    /* parse IHDR (must be first chunk) */
    len = avio_rb32(pb);
    tag = avio_rl32(pb);
    if (len != 13 || tag != MKTAG('I', 'H', 'D', 'R'))
        return AVERROR_INVALIDDATA;

    st = avformat_new_stream(s, NULL);
    if (!st)
        return AVERROR(ENOMEM);

    /* set the timebase to something large enough (1/100,000 of second)
     * to hopefully cope with all sane frame durations */
    avpriv_set_pts_info(st, 64, 1, 100000);
    st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
    st->codecpar->codec_id   = AV_CODEC_ID_APNG;
    st->codecpar->width      = avio_rb32(pb);
    st->codecpar->height     = avio_rb32(pb);
    if ((ret = av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s)) < 0)
        return ret;

    /* extradata will contain every chunk up to the first fcTL (excluded) */
    ret = ff_alloc_extradata(st->codecpar, len + 12);
    if (ret < 0)
        return ret;
    AV_WB32(st->codecpar->extradata,    len);
    AV_WL32(st->codecpar->extradata+4,  tag);
    AV_WB32(st->codecpar->extradata+8,  st->codecpar->width);
    AV_WB32(st->codecpar->extradata+12, st->codecpar->height);
    if ((ret = ffio_read_size(pb, st->codecpar->extradata + 16, 9)) < 0)
        return ret;

    while (1) {
        if (acTL_found && ctx->num_play != 1) {
            int64_t size   = avio_size(pb);
            int64_t offset = avio_tell(pb);
            if (size < 0) {
                return size;
            } else if (offset < 0) {
                return offset;
            } else if ((ret = ffio_ensure_seekback(pb, size - offset)) < 0) {
                av_log(s, AV_LOG_WARNING, "Could not ensure seekback, will not loop\n");
                ctx->num_play = 1;
            }
        }
        if ((ctx->num_play == 1 || !acTL_found) &&
            ((ret = ffio_ensure_seekback(pb, 4 /* len */ + 4 /* tag */)) < 0))
            return ret;

        len = avio_rb32(pb);
        if (len > INT_MAX - 12)
            return AVERROR_INVALIDDATA;

        tag = avio_rl32(pb);
        switch (tag) {
        case MKTAG('a', 'c', 'T', 'L'):
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = append_extradata(st->codecpar, pb, len + 12)) < 0)
                return ret;
            acTL_found = 1;
            ctx->num_frames = AV_RB32(st->codecpar->extradata + ret + 8);
            ctx->num_play   = AV_RB32(st->codecpar->extradata + ret + 12);
            av_log(s, AV_LOG_DEBUG, "num_frames: %"PRIu32", num_play: %"PRIu32"\n",
                                    ctx->num_frames, ctx->num_play);
            break;
        case MKTAG('f', 'c', 'T', 'L'):
            if (!acTL_found || len != APNG_FCTL_CHUNK_SIZE) {
                return AVERROR_INVALIDDATA;
            }
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
                return ret;
            return 0;
        default:
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = append_extradata(st->codecpar, pb, len + 12)) < 0)
                return ret;
        }
    }
}

static int decode_fctl_chunk(AVFormatContext *s, APNGDemuxContext *ctx, AVPacket *pkt)
{
    uint32_t sequence_number, width, height, x_offset, y_offset;
    uint16_t delay_num, delay_den;
    uint8_t dispose_op, blend_op;

    sequence_number = avio_rb32(s->pb);
    width           = avio_rb32(s->pb);
    height          = avio_rb32(s->pb);
    x_offset        = avio_rb32(s->pb);
    y_offset        = avio_rb32(s->pb);
    delay_num       = avio_rb16(s->pb);
    delay_den       = avio_rb16(s->pb);
    dispose_op      = avio_r8(s->pb);
    blend_op        = avio_r8(s->pb);
    avio_skip(s->pb, 4); /* crc */

    /* default is hundredths of seconds */
    if (!delay_den)
        delay_den = 100;
    if (!delay_num || (ctx->max_fps && delay_den / delay_num > ctx->max_fps)) {
        delay_num = 1;
        delay_den = ctx->default_fps;
    }
    ctx->pkt_duration = av_rescale_q(delay_num,
                                     (AVRational){ 1, delay_den },
                                     s->streams[0]->time_base);

    av_log(s, AV_LOG_DEBUG, "%s: "
            "sequence_number: %"PRId32", "
            "width: %"PRIu32", "
            "height: %"PRIu32", "
            "x_offset: %"PRIu32", "
            "y_offset: %"PRIu32", "
            "delay_num: %"PRIu16", "
            "delay_den: %"PRIu16", "
            "dispose_op: %d, "
            "blend_op: %d\n",
            __func__,
            sequence_number,
            width,
            height,
            x_offset,
            y_offset,
            delay_num,
            delay_den,
            dispose_op,
            blend_op);

    if (width != s->streams[0]->codecpar->width ||
        height != s->streams[0]->codecpar->height ||
        x_offset != 0 ||
        y_offset != 0) {
        if (sequence_number == 0 ||
            x_offset >= s->streams[0]->codecpar->width ||
            width > s->streams[0]->codecpar->width - x_offset ||
            y_offset >= s->streams[0]->codecpar->height ||
            height > s->streams[0]->codecpar->height - y_offset)
            return AVERROR_INVALIDDATA;
        ctx->is_key_frame = 0;
    } else {
        if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS)
            dispose_op = APNG_DISPOSE_OP_BACKGROUND;
        ctx->is_key_frame = dispose_op == APNG_DISPOSE_OP_BACKGROUND ||
                            blend_op   == APNG_BLEND_OP_SOURCE;
    }

    return 0;
}

static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
{
    APNGDemuxContext *ctx = s->priv_data;
    int64_t ret;
    int64_t size;
    AVIOContext *pb = s->pb;
    uint32_t len, tag;

    /*
     * fcTL chunk length, in bytes:
     *  4 (length)
     *  4 (tag)
     * 26 (actual chunk)
     *  4 (crc) bytes
     * and needed next:
     *  4 (length)
     *  4 (tag (must be fdAT or IDAT))
     */
    /* if num_play is not 1, then the seekback is already guaranteed */
    if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 46)) < 0)
        return ret;

    len = avio_rb32(pb);
    tag = avio_rl32(pb);

    if (avio_feof(pb))
        return AVERROR_EOF;

    switch (tag) {
    case MKTAG('f', 'c', 'T', 'L'):
        if (len != APNG_FCTL_CHUNK_SIZE)
            return AVERROR_INVALIDDATA;

        if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
            return ret;

        /* fcTL may be followed by other chunks before fdAT or IDAT */
        len = avio_rb32(pb);
        tag = avio_rl32(pb);
        if (len > 0x7fffffff)
            return AVERROR_INVALIDDATA;

        /* check for empty frame */
        if (tag == MKTAG('f', 'c', 'T', 'L') ||
            tag == MKTAG('I', 'E', 'N', 'D'))
            return AVERROR_INVALIDDATA;

        size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;
        if (size > INT_MAX)
            return AVERROR(EINVAL);

        if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 ||
            (ret = av_append_packet(pb, pkt, size)) < 0)
            return ret;

        if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
            return ret;

        len = avio_rb32(pb);
        tag = avio_rl32(pb);
        while (tag &&
               tag != MKTAG('f', 'c', 'T', 'L') &&
               tag != MKTAG('I', 'E', 'N', 'D')) {
            if (len > 0x7fffffff)
                return AVERROR_INVALIDDATA;
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = av_append_packet(pb, pkt, len + 12)) < 0)
                return ret;
            if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
                return ret;
            len = avio_rb32(pb);
            tag = avio_rl32(pb);
        }
        if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
            return ret;

        if (ctx->is_key_frame)
            pkt->flags |= AV_PKT_FLAG_KEY;
        pkt->pts = pkt->dts = AV_NOPTS_VALUE;
        pkt->duration = ctx->pkt_duration;
        return ret;
    case MKTAG('I', 'E', 'N', 'D'):
        ctx->cur_loop++;
        if (ctx->ignore_loop || ctx->num_play >= 1 && ctx->cur_loop == ctx->num_play) {
            avio_seek(pb, -8, SEEK_CUR);
            return AVERROR_EOF;
        }
        if ((ret = avio_seek(pb, s->streams[0]->codecpar->extradata_size + 8, SEEK_SET)) < 0)
            return ret;
        return 0;
    default:
        avpriv_request_sample(s, "In-stream tag=%s (0x%08"PRIX32") len=%"PRIu32,
                              av_fourcc2str(tag), tag, len);
        avio_skip(pb, len + 4);
    }

    /* Handle the unsupported yet cases */
    return AVERROR_PATCHWELCOME;
}

static const AVOption options[] = {
    { "ignore_loop", "ignore loop setting"                         , offsetof(APNGDemuxContext, ignore_loop),
      AV_OPT_TYPE_BOOL, { .i64 = 1 }              , 0, 1      , AV_OPT_FLAG_DECODING_PARAM },
    { "max_fps"    , "maximum framerate (0 is no limit)"           , offsetof(APNGDemuxContext, max_fps),
      AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
    { "default_fps", "default framerate (0 is as fast as possible)", offsetof(APNGDemuxContext, default_fps),
      AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
    { NULL },
};

static const AVClass demuxer_class = {
    .class_name = "APNG demuxer",
    .item_name  = av_default_item_name,
    .option     = options,
    .version    = LIBAVUTIL_VERSION_INT,
    .category   = AV_CLASS_CATEGORY_DEMUXER,
};

const FFInputFormat ff_apng_demuxer = {
    .p.name         = "apng",
    .p.long_name    = NULL_IF_CONFIG_SMALL("Animated Portable Network Graphics"),
    .p.flags        = AVFMT_GENERIC_INDEX,
    .p.priv_class   = &demuxer_class,
    .priv_data_size = sizeof(APNGDemuxContext),
    .read_probe     = apng_probe,
    .read_header    = apng_read_header,
    .read_packet    = apng_read_packet,
};

Coverage Report

Created: 2026-04-01 07:42

Line	Count	Source
1		/*
2		* APNG demuxer
3		* Copyright (c) 2014 Benoit Fouet
4		*
5		* This file is part of FFmpeg.
6		*
7		* FFmpeg is free software; you can redistribute it and/or
8		* modify it under the terms of the GNU Lesser General Public
9		* License as published by the Free Software Foundation; either
10		* version 2.1 of the License, or (at your option) any later version.
11		*
12		* FFmpeg is distributed in the hope that it will be useful,
13		* but WITHOUT ANY WARRANTY; without even the implied warranty of
14		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15		* Lesser General Public License for more details.
16		*
17		* You should have received a copy of the GNU Lesser General Public
18		* License along with FFmpeg; if not, write to the Free Software
19		* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20		*/
21
22		/**
23		* @file
24		* APNG demuxer.
25		* @see https://wiki.mozilla.org/APNG_Specification
26		* @see http://www.w3.org/TR/PNG
27		*/
28
29		#include "avformat.h"
30		#include "avio_internal.h"
31		#include "demux.h"
32		#include "internal.h"
33		#include "libavutil/imgutils.h"
34		#include "libavutil/intreadwrite.h"
35		#include "libavutil/mem.h"
36		#include "libavutil/opt.h"
37		#include "libavcodec/apng.h"
38		#include "libavcodec/png.h"
39		#include "libavcodec/bytestream.h"
40
41		#define DEFAULT_APNG_FPS 15
42
43		typedef struct APNGDemuxContext {
44		const AVClass *class;
45
46		int max_fps;
47		int default_fps;
48
49		int pkt_duration;
50
51		int is_key_frame;
52
53		/*
54		* loop options
55		*/
56		int ignore_loop;
57		uint32_t num_frames;
58		uint32_t num_play;
59		uint32_t cur_loop;
60		} APNGDemuxContext;
61
62		/*
63		* To be a valid APNG file, we mandate, in this order:
64		* PNGSIG
65		* IHDR
66		* ...
67		* acTL
68		* ...
69		* IDAT
70		*/
71		static int apng_probe(const AVProbeData *p)
72	959k	{
73	959k	GetByteContext gb;
74	959k	int state = 0;
75	959k	uint32_t len, tag;
76
77	959k	bytestream2_init(&gb, p->buf, p->buf_size);
78
79	959k	if (bytestream2_get_be64(&gb) != PNGSIG)
80	954k	return 0;
81
82	13.1k	for (;;) {
83	13.1k	len = bytestream2_get_be32(&gb);
84	13.1k	if (len > 0x7fffffff)
85	384	return 0;
86
87	12.7k	tag = bytestream2_get_le32(&gb);
88		/* we don't check IDAT size, as this is the last tag
89		* we check, and it may be larger than the probe buffer */
90	12.7k	if (tag != MKTAG('I', 'D', 'A', 'T') &&
91	12.6k	len + 4 > bytestream2_get_bytes_left(&gb))
92	3.88k	return 0;
93
94	8.88k	switch (tag) {
95	497	case MKTAG('I', 'H', 'D', 'R'):
96	497	if (len != 13)
97	15	return 0;
98	482	if (av_image_check_size(bytestream2_get_be32(&gb), bytestream2_get_be32(&gb), 0, NULL))
99	132	return 0;
100	350	bytestream2_skip(&gb, 9);
101	350	state++;
102	350	break;
103	194	case MKTAG('a', 'c', 'T', 'L'):
104	194	if (state != 1 \|\|
105	168	len != 8 \|\|
106	140	bytestream2_get_be32(&gb) == 0) /* 0 is not a valid value for number of frames */
107	62	return 0;
108	132	bytestream2_skip(&gb, 8);
109	132	state++;
110	132	break;
111	135	case MKTAG('I', 'D', 'A', 'T'):
112	135	if (state != 2)
113	28	return 0;
114	107	goto end;
115	8.05k	default:
116		/* skip other tags */
117	8.05k	bytestream2_skip(&gb, len + 4);
118	8.05k	break;
119	8.88k	}
120	8.88k	}
121
122	107	end:
123	107	return AVPROBE_SCORE_MAX;
124	4.61k	}
125
126		static int append_extradata(AVCodecParameters par, AVIOContext pb, int len)
127	10.9k	{
128	10.9k	int previous_size = par->extradata_size;
129	10.9k	int new_size, ret;
130	10.9k	uint8_t *new_extradata;
131
132	10.9k	if (len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - previous_size)
133	29	return AVERROR_INVALIDDATA;
134
135	10.9k	new_size = previous_size + len;
136	10.9k	new_extradata = av_realloc(par->extradata, new_size + AV_INPUT_BUFFER_PADDING_SIZE);
137	10.9k	if (!new_extradata)
138	0	return AVERROR(ENOMEM);
139	10.9k	memset(new_extradata + new_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
140	10.9k	par->extradata = new_extradata;
141	10.9k	par->extradata_size = new_size;
142
143	10.9k	if ((ret = ffio_read_size(pb, par->extradata + previous_size, len)) < 0)
144	387	return ret;
145
146	10.5k	return previous_size;
147	10.9k	}
148
149		static int apng_read_header(AVFormatContext *s)
150	4.39k	{
151	4.39k	APNGDemuxContext *ctx = s->priv_data;
152	4.39k	AVIOContext *pb = s->pb;
153	4.39k	uint32_t len, tag;
154	4.39k	AVStream *st;
155	4.39k	int acTL_found = 0;
156	4.39k	int64_t ret;
157
158		/* verify PNGSIG */
159	4.39k	if (avio_rb64(pb) != PNGSIG)
160	226	return AVERROR_INVALIDDATA;
161
162		/* parse IHDR (must be first chunk) */
163	4.17k	len = avio_rb32(pb);
164	4.17k	tag = avio_rl32(pb);
165	4.17k	if (len != 13 \|\| tag != MKTAG('I', 'H', 'D', 'R'))
166	103	return AVERROR_INVALIDDATA;
167
168	4.07k	st = avformat_new_stream(s, NULL);
169	4.07k	if (!st)
170	0	return AVERROR(ENOMEM);
171
172		/* set the timebase to something large enough (1/100,000 of second)
173		* to hopefully cope with all sane frame durations */
174	4.07k	avpriv_set_pts_info(st, 64, 1, 100000);
175	4.07k	st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
176	4.07k	st->codecpar->codec_id = AV_CODEC_ID_APNG;
177	4.07k	st->codecpar->width = avio_rb32(pb);
178	4.07k	st->codecpar->height = avio_rb32(pb);
179	4.07k	if ((ret = av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s)) < 0)
180	181	return ret;
181
182		/* extradata will contain every chunk up to the first fcTL (excluded) */
183	3.88k	ret = ff_alloc_extradata(st->codecpar, len + 12);
184	3.88k	if (ret < 0)
185	0	return ret;
186	3.88k	AV_WB32(st->codecpar->extradata, len);
187	3.88k	AV_WL32(st->codecpar->extradata+4, tag);
188	3.88k	AV_WB32(st->codecpar->extradata+8, st->codecpar->width);
189	3.88k	AV_WB32(st->codecpar->extradata+12, st->codecpar->height);
190	3.88k	if ((ret = ffio_read_size(pb, st->codecpar->extradata + 16, 9)) < 0)
191	36	return ret;
192
193	14.4k	while (1) {
194	14.4k	if (acTL_found && ctx->num_play != 1) {
195	2.17k	int64_t size = avio_size(pb);
196	2.17k	int64_t offset = avio_tell(pb);
197	2.17k	if (size < 0) {
198	63	return size;
199	2.11k	} else if (offset < 0) {
200	0	return offset;
201	2.11k	} else if ((ret = ffio_ensure_seekback(pb, size - offset)) < 0) {
202	858	av_log(s, AV_LOG_WARNING, "Could not ensure seekback, will not loop\n");
203	858	ctx->num_play = 1;
204	858	}
205	2.17k	}
206	14.3k	if ((ctx->num_play == 1 \|\| !acTL_found) &&
207	13.0k	((ret = ffio_ensure_seekback(pb, 4 /* len / + 4 / tag */)) < 0))
208	0	return ret;
209
210	14.3k	len = avio_rb32(pb);
211	14.3k	if (len > INT_MAX - 12)
212	58	return AVERROR_INVALIDDATA;
213
214	14.2k	tag = avio_rl32(pb);
215	14.2k	switch (tag) {
216	3.90k	case MKTAG('a', 'c', 'T', 'L'):
217	3.90k	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
218	3.90k	(ret = append_extradata(st->codecpar, pb, len + 12)) < 0)
219	49	return ret;
220	3.85k	acTL_found = 1;
221	3.85k	ctx->num_frames = AV_RB32(st->codecpar->extradata + ret + 8);
222	3.85k	ctx->num_play = AV_RB32(st->codecpar->extradata + ret + 12);
223	3.85k	av_log(s, AV_LOG_DEBUG, "num_frames: %"PRIu32", num_play: %"PRIu32"\n",
224	3.85k	ctx->num_frames, ctx->num_play);
225	3.85k	break;
226	3.14k	case MKTAG('f', 'c', 'T', 'L'):
227	3.14k	if (!acTL_found \|\| len != APNG_FCTL_CHUNK_SIZE) {
228	34	return AVERROR_INVALIDDATA;
229	34	}
230	3.11k	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
231	4	return ret;
232	3.11k	return 0;
233	7.24k	default:
234	7.24k	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
235	7.07k	(ret = append_extradata(st->codecpar, pb, len + 12)) < 0)
236	535	return ret;
237	14.2k	}
238	14.2k	}
239	3.85k	}
240
241		static int decode_fctl_chunk(AVFormatContext s, APNGDemuxContext ctx, AVPacket *pkt)
242	71.1k	{
243	71.1k	uint32_t sequence_number, width, height, x_offset, y_offset;
244	71.1k	uint16_t delay_num, delay_den;
245	71.1k	uint8_t dispose_op, blend_op;
246
247	71.1k	sequence_number = avio_rb32(s->pb);
248	71.1k	width = avio_rb32(s->pb);
249	71.1k	height = avio_rb32(s->pb);
250	71.1k	x_offset = avio_rb32(s->pb);
251	71.1k	y_offset = avio_rb32(s->pb);
252	71.1k	delay_num = avio_rb16(s->pb);
253	71.1k	delay_den = avio_rb16(s->pb);
254	71.1k	dispose_op = avio_r8(s->pb);
255	71.1k	blend_op = avio_r8(s->pb);
256	71.1k	avio_skip(s->pb, 4); /* crc */
257
258		/* default is hundredths of seconds */
259	71.1k	if (!delay_den)
260	2.62k	delay_den = 100;
261	71.1k	if (!delay_num \|\| (ctx->max_fps && delay_den / delay_num > ctx->max_fps)) {
262	2.40k	delay_num = 1;
263	2.40k	delay_den = ctx->default_fps;
264	2.40k	}
265	71.1k	ctx->pkt_duration = av_rescale_q(delay_num,
266	71.1k	(AVRational){ 1, delay_den },
267	71.1k	s->streams[0]->time_base);
268
269	71.1k	av_log(s, AV_LOG_DEBUG, "%s: "
270	71.1k	"sequence_number: %"PRId32", "
271	71.1k	"width: %"PRIu32", "
272	71.1k	"height: %"PRIu32", "
273	71.1k	"x_offset: %"PRIu32", "
274	71.1k	"y_offset: %"PRIu32", "
275	71.1k	"delay_num: %"PRIu16", "
276	71.1k	"delay_den: %"PRIu16", "
277	71.1k	"dispose_op: %d, "
278	71.1k	"blend_op: %d\n",
279	71.1k	__func__,
280	71.1k	sequence_number,
281	71.1k	width,
282	71.1k	height,
283	71.1k	x_offset,
284	71.1k	y_offset,
285	71.1k	delay_num,
286	71.1k	delay_den,
287	71.1k	dispose_op,
288	71.1k	blend_op);
289
290	71.1k	if (width != s->streams[0]->codecpar->width \|\|
291	52.0k	height != s->streams[0]->codecpar->height \|\|
292	50.9k	x_offset != 0 \|\|
293	50.8k	y_offset != 0) {
294	20.3k	if (sequence_number == 0 \|\|
295	19.9k	x_offset >= s->streams[0]->codecpar->width \|\|
296	19.6k	width > s->streams[0]->codecpar->width - x_offset \|\|
297	19.4k	y_offset >= s->streams[0]->codecpar->height \|\|
298	19.2k	height > s->streams[0]->codecpar->height - y_offset)
299	1.15k	return AVERROR_INVALIDDATA;
300	19.1k	ctx->is_key_frame = 0;
301	50.8k	} else {
302	50.8k	if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS)
303	13	dispose_op = APNG_DISPOSE_OP_BACKGROUND;
304	50.8k	ctx->is_key_frame = dispose_op == APNG_DISPOSE_OP_BACKGROUND \|\|
305	50.6k	blend_op == APNG_BLEND_OP_SOURCE;
306	50.8k	}
307
308	69.9k	return 0;
309	71.1k	}
310
311		static int apng_read_packet(AVFormatContext s, AVPacket pkt)
312	74.6k	{
313	74.6k	APNGDemuxContext *ctx = s->priv_data;
314	74.6k	int64_t ret;
315	74.6k	int64_t size;
316	74.6k	AVIOContext *pb = s->pb;
317	74.6k	uint32_t len, tag;
318
319		/*
320		* fcTL chunk length, in bytes:
321		* 4 (length)
322		* 4 (tag)
323		* 26 (actual chunk)
324		* 4 (crc) bytes
325		* and needed next:
326		* 4 (length)
327		* 4 (tag (must be fdAT or IDAT))
328		*/
329		/* if num_play is not 1, then the seekback is already guaranteed */
330	74.6k	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 46)) < 0)
331	0	return ret;
332
333	74.6k	len = avio_rb32(pb);
334	74.6k	tag = avio_rl32(pb);
335
336	74.6k	if (avio_feof(pb))
337	1.93k	return AVERROR_EOF;
338
339	72.6k	switch (tag) {
340	71.3k	case MKTAG('f', 'c', 'T', 'L'):
341	71.3k	if (len != APNG_FCTL_CHUNK_SIZE)
342	182	return AVERROR_INVALIDDATA;
343
344	71.1k	if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
345	1.15k	return ret;
346
347		/* fcTL may be followed by other chunks before fdAT or IDAT */
348	69.9k	len = avio_rb32(pb);
349	69.9k	tag = avio_rl32(pb);
350	69.9k	if (len > 0x7fffffff)
351	58	return AVERROR_INVALIDDATA;
352
353		/* check for empty frame */
354	69.9k	if (tag == MKTAG('f', 'c', 'T', 'L') \|\|
355	69.9k	tag == MKTAG('I', 'E', 'N', 'D'))
356	7	return AVERROR_INVALIDDATA;
357
358	69.9k	size = 38 /* fcTL / + 8 / len, tag / + len + 4 / crc */;
359	69.9k	if (size > INT_MAX)
360	4	return AVERROR(EINVAL);
361
362	69.9k	if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 \|\|
363	69.6k	(ret = av_append_packet(pb, pkt, size)) < 0)
364	436	return ret;
365
366	69.4k	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
367	0	return ret;
368
369	69.4k	len = avio_rb32(pb);
370	69.4k	tag = avio_rl32(pb);
371	81.4k	while (tag &&
372	80.0k	tag != MKTAG('f', 'c', 'T', 'L') &&
373	12.1k	tag != MKTAG('I', 'E', 'N', 'D')) {
374	12.1k	if (len > 0x7fffffff)
375	75	return AVERROR_INVALIDDATA;
376	12.0k	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
377	12.0k	(ret = av_append_packet(pb, pkt, len + 12)) < 0)
378	41	return ret;
379	12.0k	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
380	0	return ret;
381	12.0k	len = avio_rb32(pb);
382	12.0k	tag = avio_rl32(pb);
383	12.0k	}
384	69.3k	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
385	435	return ret;
386
387	68.9k	if (ctx->is_key_frame)
388	50.1k	pkt->flags \|= AV_PKT_FLAG_KEY;
389	68.9k	pkt->pts = pkt->dts = AV_NOPTS_VALUE;
390	68.9k	pkt->duration = ctx->pkt_duration;
391	68.9k	return ret;
392	23	case MKTAG('I', 'E', 'N', 'D'):
393	23	ctx->cur_loop++;
394	23	if (ctx->ignore_loop \|\| ctx->num_play >= 1 && ctx->cur_loop == ctx->num_play) {
395	23	avio_seek(pb, -8, SEEK_CUR);
396	23	return AVERROR_EOF;
397	23	}
398	0	if ((ret = avio_seek(pb, s->streams[0]->codecpar->extradata_size + 8, SEEK_SET)) < 0)
399	0	return ret;
400	0	return 0;
401	1.33k	default:
402	1.33k	avpriv_request_sample(s, "In-stream tag=%s (0x%08"PRIX32") len=%"PRIu32,
403	1.33k	av_fourcc2str(tag), tag, len);
404	1.33k	avio_skip(pb, len + 4);
405	72.6k	}
406
407		/* Handle the unsupported yet cases */
408	1.33k	return AVERROR_PATCHWELCOME;
409	72.6k	}
410
411		static const AVOption options[] = {
412		{ "ignore_loop", "ignore loop setting" , offsetof(APNGDemuxContext, ignore_loop),
413		AV_OPT_TYPE_BOOL, { .i64 = 1 } , 0, 1 , AV_OPT_FLAG_DECODING_PARAM },
414		{ "max_fps" , "maximum framerate (0 is no limit)" , offsetof(APNGDemuxContext, max_fps),
415		AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
416		{ "default_fps", "default framerate (0 is as fast as possible)", offsetof(APNGDemuxContext, default_fps),
417		AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
418		{ NULL },
419		};
420
421		static const AVClass demuxer_class = {
422		.class_name = "APNG demuxer",
423		.item_name = av_default_item_name,
424		.option = options,
425		.version = LIBAVUTIL_VERSION_INT,
426		.category = AV_CLASS_CATEGORY_DEMUXER,
427		};
428
429		const FFInputFormat ff_apng_demuxer = {
430		.p.name = "apng",
431		.p.long_name = NULL_IF_CONFIG_SMALL("Animated Portable Network Graphics"),
432		.p.flags = AVFMT_GENERIC_INDEX,
433		.p.priv_class = &demuxer_class,
434		.priv_data_size = sizeof(APNGDemuxContext),
435		.read_probe = apng_probe,
436		.read_header = apng_read_header,
437		.read_packet = apng_read_packet,
438		};