Coverage Report

Created: 2026-03-12 07:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/mpv/demux/packet.c
Line
Count
Source
1
/*
2
 * This file is part of mpv.
3
 *
4
 * mpv is free software; you can redistribute it and/or
5
 * modify it under the terms of the GNU Lesser General Public
6
 * License as published by the Free Software Foundation; either
7
 * version 2.1 of the License, or (at your option) any later version.
8
 *
9
 * mpv is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU Lesser General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU Lesser General Public
15
 * License along with mpv.  If not, see <http://www.gnu.org/licenses/>.
16
 */
17
18
#include <stdlib.h>
19
#include <stdio.h>
20
#include <string.h>
21
#include <assert.h>
22
23
#include <libavcodec/avcodec.h>
24
#include <libavutil/hdr_dynamic_metadata.h>
25
#include <libavutil/imgutils.h>
26
#include <libavutil/intreadwrite.h>
27
28
#include "common/av_common.h"
29
#include "common/common.h"
30
#include "demux.h"
31
#include "demux/ebml.h"
32
#include "packet_pool.h"
33
34
#include "packet.h"
35
36
// Free any refcounted data dp holds (but don't free dp itself). This does not
37
// care about pointers that are _not_ refcounted (like demux_packet.codec).
38
// Normally, a user should use talloc_free(dp). This function is only for
39
// annoyingly specific obscure use cases.
40
void demux_packet_unref_contents(struct demux_packet *dp)
41
2.14M
{
42
2.14M
    if (dp->avpacket) {
43
2.14M
        mp_assert(!dp->is_cached);
44
2.14M
        av_packet_free(&dp->avpacket);
45
2.14M
        dp->buffer = NULL;
46
2.14M
        dp->len = 0;
47
2.14M
        dp->is_wrapped_avframe = false;
48
2.14M
    }
49
2.14M
}
50
51
static void packet_destroy(void *ptr)
52
2.14M
{
53
2.14M
    struct demux_packet *dp = ptr;
54
2.14M
    demux_packet_unref_contents(dp);
55
2.14M
}
56
57
static void set_packet_defaults(struct demux_packet *dp)
58
21.0M
{
59
21.0M
    *dp = (struct demux_packet) {
60
21.0M
        .pts = MP_NOPTS_VALUE,
61
21.0M
        .dts = MP_NOPTS_VALUE,
62
21.0M
        .duration = -1,
63
21.0M
        .pos = -1,
64
21.0M
        .start = MP_NOPTS_VALUE,
65
21.0M
        .end = MP_NOPTS_VALUE,
66
21.0M
        .stream = -1,
67
21.0M
        .animated = -1,
68
21.0M
    };
69
21.0M
}
70
71
// This frees a packet backing allocations, but does not free dp itself, or
72
// AVPacket inside dp, which is restored to default state.
73
void demux_packet_unref(struct demux_packet *dp)
74
21.0M
{
75
21.0M
    if (!dp)
76
2.14M
        return;
77
18.9M
    struct AVPacket *avpkt = dp ? dp->avpacket : NULL;
78
18.9M
    if (avpkt)
79
18.9M
        av_packet_unref(avpkt);
80
18.9M
    ta_free_children(dp);
81
18.9M
    set_packet_defaults(dp);
82
18.9M
    dp->avpacket = avpkt;
83
18.9M
}
84
85
static struct demux_packet *packet_create(struct demux_packet_pool *pool)
86
11.1M
{
87
11.1M
    struct demux_packet *dp = pool ? demux_packet_pool_pop(pool) : NULL;
88
11.1M
    if (!dp) {
89
2.14M
        dp = talloc(NULL, struct demux_packet);
90
2.14M
        talloc_set_destructor(dp, packet_destroy);
91
2.14M
        set_packet_defaults(dp);
92
2.14M
    }
93
11.1M
    if (!dp->avpacket)
94
2.14M
        dp->avpacket = av_packet_alloc();
95
11.1M
    MP_HANDLE_OOM(dp->avpacket);
96
11.1M
    return dp;
97
11.1M
}
98
99
// This actually preserves only data and side data, not PTS/DTS/pos/etc.
100
// It also allows avpkt->data==NULL with avpkt->size!=0 - the libavcodec API
101
// does not allow it, but we do it to simplify new_demux_packet().
102
struct demux_packet *new_demux_packet_from_avpacket(struct demux_packet_pool *pool,
103
                                                    struct AVPacket *avpkt)
104
10.8M
{
105
10.8M
    if (avpkt->size > 1000000000)
106
0
        return NULL;
107
10.8M
    struct demux_packet *dp = packet_create(pool);
108
10.8M
    int r = -1;
109
10.8M
    if (avpkt->data) {
110
        // We hope that this function won't need/access AVPacket input padding,
111
        // because otherwise new_demux_packet_from() wouldn't work.
112
10.8M
        r = av_packet_ref(dp->avpacket, avpkt);
113
18.4E
    } else {
114
18.4E
        r = av_new_packet(dp->avpacket, avpkt->size);
115
18.4E
    }
116
10.8M
    if (r < 0) {
117
0
        talloc_free(dp);
118
0
        return NULL;
119
0
    }
120
10.8M
    dp->buffer = dp->avpacket->data;
121
10.8M
    dp->len = dp->avpacket->size;
122
10.8M
    return dp;
123
10.8M
}
124
125
// (buf must include proper padding)
126
struct demux_packet *new_demux_packet_from_buf(struct demux_packet_pool *pool,
127
                                               struct AVBufferRef *buf)
128
639k
{
129
639k
    if (!buf)
130
367k
        return NULL;
131
272k
    if (buf->size > 1000000000)
132
0
        return NULL;
133
134
272k
    struct demux_packet *dp = packet_create(pool);
135
272k
    dp->avpacket->buf = av_buffer_ref(buf);
136
272k
    if (!dp->avpacket->buf) {
137
0
        talloc_free(dp);
138
0
        return NULL;
139
0
    }
140
272k
    dp->avpacket->data = dp->buffer = buf->data;
141
272k
    dp->avpacket->size = dp->len = buf->size;
142
272k
    return dp;
143
272k
}
144
145
// Input data doesn't need to be padded.
146
struct demux_packet *new_demux_packet_from(struct demux_packet_pool *pool, void *data, size_t len)
147
53.6k
{
148
53.6k
    struct demux_packet *dp = new_demux_packet(pool, len);
149
53.6k
    if (!dp)
150
0
        return NULL;
151
53.6k
    memcpy(dp->avpacket->data, data, len);
152
53.6k
    return dp;
153
53.6k
}
154
155
struct demux_packet *new_demux_packet(struct demux_packet_pool *pool, size_t len)
156
57.9k
{
157
57.9k
    if (len > INT_MAX)
158
0
        return NULL;
159
160
57.9k
    struct demux_packet *dp = packet_create(pool);
161
57.9k
    int r = av_new_packet(dp->avpacket, len);
162
57.9k
    if (r < 0) {
163
0
        talloc_free(dp);
164
0
        return NULL;
165
0
    }
166
57.9k
    dp->buffer = dp->avpacket->data;
167
57.9k
    dp->len = len;
168
57.9k
    return dp;
169
57.9k
}
170
171
void demux_packet_shorten(struct demux_packet *dp, size_t len)
172
0
{
173
0
    mp_assert(len <= dp->len);
174
0
    if (dp->len) {
175
0
        dp->len = len;
176
0
        memset(dp->buffer + dp->len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
177
0
    }
178
0
}
179
180
void free_demux_packet(struct demux_packet *dp)
181
2.13M
{
182
2.13M
    talloc_free(dp);
183
2.13M
}
184
185
void demux_packet_copy_attribs(struct demux_packet *dst, struct demux_packet *src)
186
5.95M
{
187
5.95M
    dst->pts = src->pts;
188
5.95M
    dst->dts = src->dts;
189
5.95M
    dst->duration = src->duration;
190
5.95M
    dst->pos = src->pos;
191
5.95M
    dst->is_wrapped_avframe = src->is_wrapped_avframe;
192
5.95M
    dst->segmented = src->segmented;
193
5.95M
    dst->start = src->start;
194
5.95M
    dst->end = src->end;
195
5.95M
    dst->codec = src->codec;
196
5.95M
    dst->back_restart = src->back_restart;
197
5.95M
    dst->back_preroll = src->back_preroll;
198
5.95M
    dst->keyframe = src->keyframe;
199
5.95M
    dst->stream = src->stream;
200
5.95M
}
201
202
struct demux_packet *demux_copy_packet(struct demux_packet_pool *pool, struct demux_packet *dp)
203
5.92M
{
204
5.92M
    struct demux_packet *new = NULL;
205
5.92M
    if (dp->avpacket) {
206
5.92M
        new = new_demux_packet_from_avpacket(pool, dp->avpacket);
207
18.4E
    } else {
208
        // Some packets might be not created by new_demux_packet*().
209
18.4E
        new = new_demux_packet_from(pool, dp->buffer, dp->len);
210
18.4E
    }
211
5.92M
    if (!new)
212
0
        return NULL;
213
5.92M
    demux_packet_copy_attribs(new, dp);
214
5.92M
    return new;
215
5.92M
}
216
217
35.7M
#define ROUND_ALLOC(s) MP_ALIGN_UP((s), 16)
218
219
// Attempt to estimate the total memory consumption of the given packet.
220
// This is important if we store thousands of packets and not to exceed
221
// user-provided limits. Of course we can't know how much memory internal
222
// fragmentation of the libc memory allocator will waste.
223
// Note that this should return a "stable" value - e.g. if a new packet ref
224
// is created, this should return the same value with the new ref. (This
225
// implies the value is not exact and does not return the actual size of
226
// memory wasted due to internal fragmentation.)
227
size_t demux_packet_estimate_total_size(struct demux_packet *dp)
228
5.93M
{
229
5.93M
    size_t size = ROUND_ALLOC(sizeof(struct demux_packet));
230
5.93M
    size += 8 * sizeof(void *); // ta  overhead
231
5.93M
    size += 10 * sizeof(void *); // additional estimate for ta_ext_header
232
5.93M
    if (dp->avpacket) {
233
5.93M
        mp_assert(!dp->is_cached);
234
5.93M
        size += ROUND_ALLOC(dp->len);
235
5.93M
        if (dp->is_wrapped_avframe) {
236
24.8k
            mp_require(dp->buffer);
237
238
24.8k
            const AVFrame *frame = (AVFrame *)dp->buffer;
239
24.8k
            if (frame->hw_frames_ctx) {
240
0
                const AVHWFramesContext *hwctx = (AVHWFramesContext *)frame->hw_frames_ctx->data;
241
0
                int r = av_image_get_buffer_size(hwctx->sw_format, hwctx->width, hwctx->height, 16);
242
0
                mp_require(r >= 0);
243
0
                size += ROUND_ALLOC(r);
244
0
            }
245
99.5k
            for (int i = 0; i < MP_ARRAY_SIZE(frame->buf) && frame->buf[i]; ++i)
246
74.6k
                size += ROUND_ALLOC(frame->buf[i]->size);
247
248
24.8k
            size += ROUND_ALLOC(frame->nb_extended_buf * sizeof(frame->extended_buf[0]));
249
24.8k
            for (int i = 0; i < frame->nb_extended_buf; ++i) {
250
0
                size += ROUND_ALLOC(sizeof(*frame->extended_buf[i]));
251
0
                size += ROUND_ALLOC(frame->extended_buf[i]->size);
252
0
            }
253
254
24.8k
            size += ROUND_ALLOC(frame->nb_side_data * sizeof(frame->side_data[0]));
255
24.8k
            for (int i = 0; i < frame->nb_side_data; ++i) {
256
0
                size += ROUND_ALLOC(sizeof(*frame->side_data[i]));
257
0
                size += ROUND_ALLOC(frame->side_data[i]->size);
258
0
            }
259
24.8k
        }
260
5.93M
        size += ROUND_ALLOC(sizeof(AVPacket));
261
5.93M
        size += 8 * sizeof(void *); // ta  overhead
262
5.93M
        size += ROUND_ALLOC(sizeof(AVBufferRef));
263
5.93M
        size += ROUND_ALLOC(64); // upper bound estimate on sizeof(AVBuffer)
264
5.93M
        size += ROUND_ALLOC(dp->avpacket->side_data_elems *
265
5.93M
                            sizeof(dp->avpacket->side_data[0]));
266
5.93M
        for (int n = 0; n < dp->avpacket->side_data_elems; n++)
267
5.93M
            size += ROUND_ALLOC(dp->avpacket->side_data[n].size);
268
5.93M
    }
269
5.93M
    return size;
270
5.93M
}
271
272
int demux_packet_set_padding(struct demux_packet *dp, int start, int end)
273
150k
{
274
150k
    if (!start && !end)
275
150k
        return 0;
276
0
    if (!dp->avpacket)
277
0
        return -1;
278
0
    uint8_t *p = av_packet_new_side_data(dp->avpacket, AV_PKT_DATA_SKIP_SAMPLES, 10);
279
0
    if (!p)
280
0
        return -1;
281
282
0
    AV_WL32(p + 0, start);
283
0
    AV_WL32(p + 4, end);
284
0
    return 0;
285
0
}
286
287
int demux_packet_add_blockadditional(struct demux_packet *dp, uint64_t id,
288
                                     void *data, size_t size)
289
0
{
290
0
    if (!dp->avpacket)
291
0
        return -1;
292
293
0
    switch (id) {
294
0
    case MATROSKA_BLOCK_ADD_ID_TYPE_ITU_T_T35: {
295
0
        static const uint8_t ITU_T_T35_COUNTRY_CODE_US = 0xB5;
296
0
        static const uint16_t ITU_T_T35_PROVIDER_CODE_SMTPE = 0x3C;
297
298
0
        if (size < 6)
299
0
            break;
300
301
0
        uint8_t *p = data;
302
303
0
        uint8_t country_code = AV_RB8(p);
304
0
        p += sizeof(country_code);
305
0
        uint16_t provider_code = AV_RB16(p);
306
0
        p += sizeof(provider_code);
307
308
0
        if (country_code != ITU_T_T35_COUNTRY_CODE_US ||
309
0
            provider_code != ITU_T_T35_PROVIDER_CODE_SMTPE)
310
0
            break;
311
312
0
        uint16_t provider_oriented_code = AV_RB16(p);
313
0
        p += sizeof(provider_oriented_code);
314
0
        uint8_t application_identifier = AV_RB8(p);
315
0
        p += sizeof(application_identifier);
316
317
0
        if (provider_oriented_code != 1 || application_identifier != 4)
318
0
            break;
319
320
0
        size_t hdrplus_size;
321
0
        AVDynamicHDRPlus *hdrplus = av_dynamic_hdr_plus_alloc(&hdrplus_size);
322
0
        MP_HANDLE_OOM(hdrplus);
323
324
0
        if (av_dynamic_hdr_plus_from_t35(hdrplus, p, size - (p - (uint8_t *)data)) < 0 ||
325
0
            av_packet_add_side_data(dp->avpacket, AV_PKT_DATA_DYNAMIC_HDR10_PLUS,
326
0
                                    (uint8_t *)hdrplus, hdrplus_size) < 0)
327
0
        {
328
0
            av_free(hdrplus);
329
0
            return -1;
330
0
        }
331
332
0
        return 0;
333
0
    }
334
0
    default:
335
0
        break;
336
0
    }
337
338
0
    uint8_t *sd = av_packet_new_side_data(dp->avpacket,
339
0
                                          AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL,
340
0
                                          8 + size);
341
0
    if (!sd)
342
0
        return -1;
343
0
    AV_WB64(sd, id);
344
0
    if (size > 0)
345
0
        memcpy(sd + 8, data, size);
346
0
    return 0;
347
0
}