Coverage Report

Created: 2025-10-27 07:04

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/mpv/demux/packet.c
Line
Count
Source
1
/*
2
 * This file is part of mpv.
3
 *
4
 * mpv is free software; you can redistribute it and/or
5
 * modify it under the terms of the GNU Lesser General Public
6
 * License as published by the Free Software Foundation; either
7
 * version 2.1 of the License, or (at your option) any later version.
8
 *
9
 * mpv is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU Lesser General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU Lesser General Public
15
 * License along with mpv.  If not, see <http://www.gnu.org/licenses/>.
16
 */
17
18
#include <stdlib.h>
19
#include <stdio.h>
20
#include <string.h>
21
#include <assert.h>
22
23
#include <libavcodec/avcodec.h>
24
#include <libavutil/hdr_dynamic_metadata.h>
25
#include <libavutil/imgutils.h>
26
#include <libavutil/intreadwrite.h>
27
28
#include "common/av_common.h"
29
#include "common/common.h"
30
#include "demux.h"
31
#include "demux/ebml.h"
32
#include "packet_pool.h"
33
34
#include "packet.h"
35
36
// Free any refcounted data dp holds (but don't free dp itself). This does not
37
// care about pointers that are _not_ refcounted (like demux_packet.codec).
38
// Normally, a user should use talloc_free(dp). This function is only for
39
// annoyingly specific obscure use cases.
40
void demux_packet_unref_contents(struct demux_packet *dp)
41
2.65M
{
42
2.65M
    if (dp->avpacket) {
43
2.65M
        mp_assert(!dp->is_cached);
44
2.65M
        av_packet_free(&dp->avpacket);
45
2.65M
        dp->buffer = NULL;
46
2.65M
        dp->len = 0;
47
2.65M
        dp->is_wrapped_avframe = false;
48
2.65M
    }
49
2.65M
}
50
51
static void packet_destroy(void *ptr)
52
2.65M
{
53
2.65M
    struct demux_packet *dp = ptr;
54
2.65M
    demux_packet_unref_contents(dp);
55
2.65M
}
56
57
static struct demux_packet *packet_create(struct demux_packet_pool *pool)
58
16.2M
{
59
16.2M
    struct demux_packet *dp = pool ? demux_packet_pool_pop(pool) : NULL;
60
16.2M
    struct AVPacket *avpkt = dp ? dp->avpacket : NULL;
61
16.2M
    if (!dp)
62
2.65M
        dp = talloc(NULL, struct demux_packet);
63
16.2M
    talloc_set_destructor(dp, packet_destroy);
64
16.2M
    *dp = (struct demux_packet) {
65
16.2M
        .pts = MP_NOPTS_VALUE,
66
16.2M
        .dts = MP_NOPTS_VALUE,
67
16.2M
        .duration = -1,
68
16.2M
        .pos = -1,
69
16.2M
        .start = MP_NOPTS_VALUE,
70
16.2M
        .end = MP_NOPTS_VALUE,
71
16.2M
        .stream = -1,
72
16.2M
        .animated = -1,
73
16.2M
    };
74
16.2M
    dp->avpacket = avpkt ? avpkt : av_packet_alloc();
75
16.2M
    MP_HANDLE_OOM(dp->avpacket);
76
16.2M
    return dp;
77
16.2M
}
78
79
// This actually preserves only data and side data, not PTS/DTS/pos/etc.
80
// It also allows avpkt->data==NULL with avpkt->size!=0 - the libavcodec API
81
// does not allow it, but we do it to simplify new_demux_packet().
82
struct demux_packet *new_demux_packet_from_avpacket(struct demux_packet_pool *pool,
83
                                                    struct AVPacket *avpkt)
84
16.0M
{
85
16.0M
    if (avpkt->size > 1000000000)
86
0
        return NULL;
87
16.0M
    struct demux_packet *dp = packet_create(pool);
88
16.0M
    int r = -1;
89
16.0M
    if (avpkt->data) {
90
        // We hope that this function won't need/access AVPacket input padding,
91
        // because otherwise new_demux_packet_from() wouldn't work.
92
16.0M
        r = av_packet_ref(dp->avpacket, avpkt);
93
18.4E
    } else {
94
18.4E
        r = av_new_packet(dp->avpacket, avpkt->size);
95
18.4E
    }
96
16.0M
    if (r < 0) {
97
0
        talloc_free(dp);
98
0
        return NULL;
99
0
    }
100
16.0M
    dp->buffer = dp->avpacket->data;
101
16.0M
    dp->len = dp->avpacket->size;
102
16.0M
    return dp;
103
16.0M
}
104
105
// (buf must include proper padding)
106
struct demux_packet *new_demux_packet_from_buf(struct demux_packet_pool *pool,
107
                                               struct AVBufferRef *buf)
108
506k
{
109
506k
    if (!buf)
110
397k
        return NULL;
111
109k
    if (buf->size > 1000000000)
112
0
        return NULL;
113
114
109k
    struct demux_packet *dp = packet_create(pool);
115
109k
    dp->avpacket->buf = av_buffer_ref(buf);
116
109k
    if (!dp->avpacket->buf) {
117
0
        talloc_free(dp);
118
0
        return NULL;
119
0
    }
120
109k
    dp->avpacket->data = dp->buffer = buf->data;
121
109k
    dp->avpacket->size = dp->len = buf->size;
122
109k
    return dp;
123
109k
}
124
125
// Input data doesn't need to be padded.
126
struct demux_packet *new_demux_packet_from(struct demux_packet_pool *pool, void *data, size_t len)
127
36.3k
{
128
36.3k
    struct demux_packet *dp = new_demux_packet(pool, len);
129
36.3k
    if (!dp)
130
0
        return NULL;
131
36.3k
    memcpy(dp->avpacket->data, data, len);
132
36.3k
    return dp;
133
36.3k
}
134
135
struct demux_packet *new_demux_packet(struct demux_packet_pool *pool, size_t len)
136
41.0k
{
137
41.0k
    if (len > INT_MAX)
138
0
        return NULL;
139
140
41.0k
    struct demux_packet *dp = packet_create(pool);
141
41.0k
    int r = av_new_packet(dp->avpacket, len);
142
41.0k
    if (r < 0) {
143
0
        talloc_free(dp);
144
0
        return NULL;
145
0
    }
146
41.0k
    dp->buffer = dp->avpacket->data;
147
41.0k
    dp->len = len;
148
41.0k
    return dp;
149
41.0k
}
150
151
void demux_packet_shorten(struct demux_packet *dp, size_t len)
152
0
{
153
0
    mp_assert(len <= dp->len);
154
0
    if (dp->len) {
155
0
        dp->len = len;
156
0
        memset(dp->buffer + dp->len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
157
0
    }
158
0
}
159
160
void free_demux_packet(struct demux_packet *dp)
161
2.61M
{
162
2.61M
    talloc_free(dp);
163
2.61M
}
164
165
void demux_packet_copy_attribs(struct demux_packet *dst, struct demux_packet *src)
166
8.65M
{
167
8.65M
    dst->pts = src->pts;
168
8.65M
    dst->dts = src->dts;
169
8.65M
    dst->duration = src->duration;
170
8.65M
    dst->pos = src->pos;
171
8.65M
    dst->is_wrapped_avframe = src->is_wrapped_avframe;
172
8.65M
    dst->segmented = src->segmented;
173
8.65M
    dst->start = src->start;
174
8.65M
    dst->end = src->end;
175
8.65M
    dst->codec = src->codec;
176
8.65M
    dst->back_restart = src->back_restart;
177
8.65M
    dst->back_preroll = src->back_preroll;
178
8.65M
    dst->keyframe = src->keyframe;
179
8.65M
    dst->stream = src->stream;
180
8.65M
}
181
182
struct demux_packet *demux_copy_packet(struct demux_packet_pool *pool, struct demux_packet *dp)
183
8.63M
{
184
8.63M
    struct demux_packet *new = NULL;
185
8.63M
    if (dp->avpacket) {
186
8.63M
        new = new_demux_packet_from_avpacket(pool, dp->avpacket);
187
18.4E
    } else {
188
        // Some packets might be not created by new_demux_packet*().
189
18.4E
        new = new_demux_packet_from(pool, dp->buffer, dp->len);
190
18.4E
    }
191
8.63M
    if (!new)
192
0
        return NULL;
193
8.63M
    demux_packet_copy_attribs(new, dp);
194
8.63M
    return new;
195
8.63M
}
196
197
52.0M
#define ROUND_ALLOC(s) MP_ALIGN_UP((s), 16)
198
199
// Attempt to estimate the total memory consumption of the given packet.
200
// This is important if we store thousands of packets and not to exceed
201
// user-provided limits. Of course we can't know how much memory internal
202
// fragmentation of the libc memory allocator will waste.
203
// Note that this should return a "stable" value - e.g. if a new packet ref
204
// is created, this should return the same value with the new ref. (This
205
// implies the value is not exact and does not return the actual size of
206
// memory wasted due to internal fragmentation.)
207
size_t demux_packet_estimate_total_size(struct demux_packet *dp)
208
8.64M
{
209
8.64M
    size_t size = ROUND_ALLOC(sizeof(struct demux_packet));
210
8.64M
    size += 8 * sizeof(void *); // ta  overhead
211
8.64M
    size += 10 * sizeof(void *); // additional estimate for ta_ext_header
212
8.64M
    if (dp->avpacket) {
213
8.64M
        mp_assert(!dp->is_cached);
214
8.64M
        size += ROUND_ALLOC(dp->len);
215
8.64M
        if (dp->is_wrapped_avframe) {
216
27.6k
            mp_require(dp->buffer);
217
218
27.6k
            const AVFrame *frame = (AVFrame *)dp->buffer;
219
27.6k
            if (frame->hw_frames_ctx) {
220
0
                const AVHWFramesContext *hwctx = (AVHWFramesContext *)frame->hw_frames_ctx->data;
221
0
                int r = av_image_get_buffer_size(hwctx->sw_format, hwctx->width, hwctx->height, 16);
222
0
                mp_require(r >= 0);
223
0
                size += ROUND_ALLOC(r);
224
0
            }
225
110k
            for (int i = 0; i < MP_ARRAY_SIZE(frame->buf) && frame->buf[i]; ++i)
226
82.8k
                size += ROUND_ALLOC(frame->buf[i]->size);
227
228
27.6k
            size += ROUND_ALLOC(frame->nb_extended_buf * sizeof(frame->extended_buf[0]));
229
27.6k
            for (int i = 0; i < frame->nb_extended_buf; ++i) {
230
0
                size += ROUND_ALLOC(sizeof(*frame->extended_buf[i]));
231
0
                size += ROUND_ALLOC(frame->extended_buf[i]->size);
232
0
            }
233
234
27.6k
            size += ROUND_ALLOC(frame->nb_side_data * sizeof(frame->side_data[0]));
235
27.6k
            for (int i = 0; i < frame->nb_side_data; ++i) {
236
0
                size += ROUND_ALLOC(sizeof(*frame->side_data[i]));
237
0
                size += ROUND_ALLOC(frame->side_data[i]->size);
238
0
            }
239
27.6k
        }
240
8.64M
        size += ROUND_ALLOC(sizeof(AVPacket));
241
8.64M
        size += 8 * sizeof(void *); // ta  overhead
242
8.64M
        size += ROUND_ALLOC(sizeof(AVBufferRef));
243
8.64M
        size += ROUND_ALLOC(64); // upper bound estimate on sizeof(AVBuffer)
244
8.64M
        size += ROUND_ALLOC(dp->avpacket->side_data_elems *
245
8.64M
                            sizeof(dp->avpacket->side_data[0]));
246
8.64M
        for (int n = 0; n < dp->avpacket->side_data_elems; n++)
247
8.64M
            size += ROUND_ALLOC(dp->avpacket->side_data[n].size);
248
8.64M
    }
249
8.64M
    return size;
250
8.64M
}
251
252
int demux_packet_set_padding(struct demux_packet *dp, int start, int end)
253
57.2k
{
254
57.2k
    if (!start && !end)
255
57.2k
        return 0;
256
0
    if (!dp->avpacket)
257
0
        return -1;
258
0
    uint8_t *p = av_packet_new_side_data(dp->avpacket, AV_PKT_DATA_SKIP_SAMPLES, 10);
259
0
    if (!p)
260
0
        return -1;
261
262
0
    AV_WL32(p + 0, start);
263
0
    AV_WL32(p + 4, end);
264
0
    return 0;
265
0
}
266
267
int demux_packet_add_blockadditional(struct demux_packet *dp, uint64_t id,
268
                                     void *data, size_t size)
269
0
{
270
0
    if (!dp->avpacket)
271
0
        return -1;
272
273
0
    switch (id) {
274
0
    case MATROSKA_BLOCK_ADD_ID_TYPE_ITU_T_T35: {
275
0
        static const uint8_t ITU_T_T35_COUNTRY_CODE_US = 0xB5;
276
0
        static const uint16_t ITU_T_T35_PROVIDER_CODE_SMTPE = 0x3C;
277
278
0
        if (size < 6)
279
0
            break;
280
281
0
        uint8_t *p = data;
282
283
0
        uint8_t country_code = AV_RB8(p);
284
0
        p += sizeof(country_code);
285
0
        uint16_t provider_code = AV_RB16(p);
286
0
        p += sizeof(provider_code);
287
288
0
        if (country_code != ITU_T_T35_COUNTRY_CODE_US ||
289
0
            provider_code != ITU_T_T35_PROVIDER_CODE_SMTPE)
290
0
            break;
291
292
0
        uint16_t provider_oriented_code = AV_RB16(p);
293
0
        p += sizeof(provider_oriented_code);
294
0
        uint8_t application_identifier = AV_RB8(p);
295
0
        p += sizeof(application_identifier);
296
297
0
        if (provider_oriented_code != 1 || application_identifier != 4)
298
0
            break;
299
300
0
        size_t hdrplus_size;
301
0
        AVDynamicHDRPlus *hdrplus = av_dynamic_hdr_plus_alloc(&hdrplus_size);
302
0
        MP_HANDLE_OOM(hdrplus);
303
304
0
        if (av_dynamic_hdr_plus_from_t35(hdrplus, p, size - (p - (uint8_t *)data)) < 0 ||
305
0
            av_packet_add_side_data(dp->avpacket, AV_PKT_DATA_DYNAMIC_HDR10_PLUS,
306
0
                                    (uint8_t *)hdrplus, hdrplus_size) < 0)
307
0
        {
308
0
            av_free(hdrplus);
309
0
            return -1;
310
0
        }
311
312
0
        return 0;
313
0
    }
314
0
    default:
315
0
        break;
316
0
    }
317
318
0
    uint8_t *sd = av_packet_new_side_data(dp->avpacket,
319
0
                                          AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL,
320
0
                                          8 + size);
321
0
    if (!sd)
322
0
        return -1;
323
0
    AV_WB64(sd, id);
324
0
    if (size > 0)
325
0
        memcpy(sd + 8, data, size);
326
0
    return 0;
327
0
}