decinfo.c 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275
  1. /********************************************************************
  2. * *
  3. * THIS FILE IS PART OF THE OggTheora SOFTWARE CODEC SOURCE CODE. *
  4. * USE, DISTRIBUTION AND REPRODUCTION OF THIS LIBRARY SOURCE IS *
  5. * GOVERNED BY A BSD-STYLE SOURCE LICENSE INCLUDED WITH THIS SOURCE *
  6. * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING. *
  7. * *
  8. * THE Theora SOURCE CODE IS COPYRIGHT (C) 2002-2009 *
  9. * by the Xiph.Org Foundation and contributors http://www.xiph.org/ *
  10. * *
  11. ********************************************************************
  12. function:
  13. last mod: $Id$
  14. ********************************************************************/
  15. #include <stdlib.h>
  16. #include <string.h>
  17. #include <limits.h>
  18. #include "decint.h"
  19. /*Only used for fuzzing.*/
  20. #if defined(HAVE_MEMORY_CONSTRAINT)
  21. static const int MAX_FUZZING_WIDTH = 16384;
  22. static const int MAX_FUZZING_HEIGHT = 16384;
  23. #endif
  24. /*Unpacks a series of octets from a given byte array into the pack buffer.
  25. No checking is done to ensure the buffer contains enough data.
  26. _opb: The pack buffer to read the octets from.
  27. _buf: The byte array to store the unpacked bytes in.
  28. _len: The number of octets to unpack.*/
  29. static void oc_unpack_octets(oc_pack_buf *_opb,char *_buf,size_t _len){
  30. while(_len-->0){
  31. long val;
  32. val=oc_pack_read(_opb,8);
  33. *_buf++=(char)val;
  34. }
  35. }
  36. /*Unpacks a 32-bit integer encoded by octets in little-endian form.*/
  37. static long oc_unpack_length(oc_pack_buf *_opb){
  38. long ret[4];
  39. int i;
  40. for(i=0;i<4;i++)ret[i]=oc_pack_read(_opb,8);
  41. return ret[0]|ret[1]<<8|ret[2]<<16|ret[3]<<24;
  42. }
  43. static int oc_info_unpack(oc_pack_buf *_opb,th_info *_info){
  44. long val;
  45. /*Check the codec bitstream version.*/
  46. val=oc_pack_read(_opb,8);
  47. _info->version_major=(unsigned char)val;
  48. val=oc_pack_read(_opb,8);
  49. _info->version_minor=(unsigned char)val;
  50. val=oc_pack_read(_opb,8);
  51. _info->version_subminor=(unsigned char)val;
  52. /*verify we can parse this bitstream version.
  53. We accept earlier minors and all subminors, by spec*/
  54. if(_info->version_major>TH_VERSION_MAJOR||
  55. (_info->version_major==TH_VERSION_MAJOR&&
  56. _info->version_minor>TH_VERSION_MINOR)){
  57. return TH_EVERSION;
  58. }
  59. /*Read the encoded frame description.*/
  60. val=oc_pack_read(_opb,16);
  61. _info->frame_width=(ogg_uint32_t)val<<4;
  62. val=oc_pack_read(_opb,16);
  63. _info->frame_height=(ogg_uint32_t)val<<4;
  64. val=oc_pack_read(_opb,24);
  65. _info->pic_width=(ogg_uint32_t)val;
  66. val=oc_pack_read(_opb,24);
  67. _info->pic_height=(ogg_uint32_t)val;
  68. val=oc_pack_read(_opb,8);
  69. _info->pic_x=(ogg_uint32_t)val;
  70. val=oc_pack_read(_opb,8);
  71. _info->pic_y=(ogg_uint32_t)val;
  72. val=oc_pack_read(_opb,32);
  73. _info->fps_numerator=(ogg_uint32_t)val;
  74. val=oc_pack_read(_opb,32);
  75. _info->fps_denominator=(ogg_uint32_t)val;
  76. if(_info->frame_width==0||_info->frame_height==0||
  77. _info->pic_width+_info->pic_x>_info->frame_width||
  78. _info->pic_height+_info->pic_y>_info->frame_height||
  79. _info->fps_numerator==0||_info->fps_denominator==0){
  80. return TH_EBADHEADER;
  81. }
  82. #if defined(HAVE_MEMORY_CONSTRAINT)
  83. if(_info->frame_width>=MAX_FUZZING_WIDTH&&_info->frame_height>=MAX_FUZZING_HEIGHT){
  84. return TH_EBADHEADER;
  85. }
  86. #endif
  87. /*Note: The sense of pic_y is inverted in what we pass back to the
  88. application compared to how it is stored in the bitstream.
  89. This is because the bitstream uses a right-handed coordinate system, while
  90. applications expect a left-handed one.*/
  91. _info->pic_y=_info->frame_height-_info->pic_height-_info->pic_y;
  92. val=oc_pack_read(_opb,24);
  93. _info->aspect_numerator=(ogg_uint32_t)val;
  94. val=oc_pack_read(_opb,24);
  95. _info->aspect_denominator=(ogg_uint32_t)val;
  96. val=oc_pack_read(_opb,8);
  97. _info->colorspace=(th_colorspace)val;
  98. val=oc_pack_read(_opb,24);
  99. _info->target_bitrate=(int)val;
  100. val=oc_pack_read(_opb,6);
  101. _info->quality=(int)val;
  102. val=oc_pack_read(_opb,5);
  103. _info->keyframe_granule_shift=(int)val;
  104. val=oc_pack_read(_opb,2);
  105. _info->pixel_fmt=(th_pixel_fmt)val;
  106. if(_info->pixel_fmt==TH_PF_RSVD)return TH_EBADHEADER;
  107. val=oc_pack_read(_opb,3);
  108. if(val!=0||oc_pack_bytes_left(_opb)<0)return TH_EBADHEADER;
  109. return 0;
  110. }
  111. static int oc_comment_unpack(oc_pack_buf *_opb,th_comment *_tc){
  112. long len;
  113. int i;
  114. /*Read the vendor string.*/
  115. len=oc_unpack_length(_opb);
  116. if(len<0||len>oc_pack_bytes_left(_opb))return TH_EBADHEADER;
  117. _tc->vendor=_ogg_malloc((size_t)len+1);
  118. if(_tc->vendor==NULL)return TH_EFAULT;
  119. oc_unpack_octets(_opb,_tc->vendor,len);
  120. _tc->vendor[len]='\0';
  121. /*Read the user comments.*/
  122. _tc->comments=(int)oc_unpack_length(_opb);
  123. len=_tc->comments;
  124. if(len<0||len>(LONG_MAX>>2)||len<<2>oc_pack_bytes_left(_opb)){
  125. _tc->comments=0;
  126. return TH_EBADHEADER;
  127. }
  128. _tc->comment_lengths=(int *)_ogg_malloc(
  129. _tc->comments*sizeof(_tc->comment_lengths[0]));
  130. _tc->user_comments=(char **)_ogg_malloc(
  131. _tc->comments*sizeof(_tc->user_comments[0]));
  132. if(_tc->comment_lengths==NULL||_tc->user_comments==NULL){
  133. _tc->comments=0;
  134. return TH_EFAULT;
  135. }
  136. for(i=0;i<_tc->comments;i++){
  137. len=oc_unpack_length(_opb);
  138. if(len<0||len>oc_pack_bytes_left(_opb)){
  139. _tc->comments=i;
  140. return TH_EBADHEADER;
  141. }
  142. _tc->comment_lengths[i]=len;
  143. _tc->user_comments[i]=_ogg_malloc((size_t)len+1);
  144. if(_tc->user_comments[i]==NULL){
  145. _tc->comments=i;
  146. return TH_EFAULT;
  147. }
  148. oc_unpack_octets(_opb,_tc->user_comments[i],len);
  149. _tc->user_comments[i][len]='\0';
  150. }
  151. return oc_pack_bytes_left(_opb)<0?TH_EBADHEADER:0;
  152. }
  153. static int oc_setup_unpack(oc_pack_buf *_opb,th_setup_info *_setup){
  154. int ret;
  155. /*Read the quantizer tables.*/
  156. ret=oc_quant_params_unpack(_opb,&_setup->qinfo);
  157. if(ret<0)return ret;
  158. /*Read the Huffman trees.*/
  159. return oc_huff_trees_unpack(_opb,_setup->huff_tables);
  160. }
  161. static void oc_setup_clear(th_setup_info *_setup){
  162. oc_quant_params_clear(&_setup->qinfo);
  163. oc_huff_trees_clear(_setup->huff_tables);
  164. }
  165. static int oc_dec_headerin(oc_pack_buf *_opb,th_info *_info,
  166. th_comment *_tc,th_setup_info **_setup,ogg_packet *_op){
  167. char buffer[6];
  168. long val;
  169. int packtype;
  170. int ret;
  171. val=oc_pack_read(_opb,8);
  172. packtype=(int)val;
  173. /*If we're at a data packet...*/
  174. if(!(packtype&0x80)){
  175. /*Check to make sure we received all three headers...
  176. If we haven't seen any valid headers, assume this is not actually
  177. Theora.*/
  178. if(_info->frame_width<=0)return TH_ENOTFORMAT;
  179. /*Follow our documentation, which says we'll return TH_EFAULT if this
  180. are NULL (_info was checked by our caller).*/
  181. if(_tc==NULL)return TH_EFAULT;
  182. /*And if any other headers were missing, declare this packet "out of
  183. sequence" instead.*/
  184. if(_tc->vendor==NULL)return TH_EBADHEADER;
  185. /*Don't check this until it's needed, since we allow passing NULL for the
  186. arguments that we're not expecting the next header to fill in yet.*/
  187. if(_setup==NULL)return TH_EFAULT;
  188. if(*_setup==NULL)return TH_EBADHEADER;
  189. /*If we got everything, we're done.*/
  190. return 0;
  191. }
  192. /*Check the codec string.*/
  193. oc_unpack_octets(_opb,buffer,6);
  194. if(memcmp(buffer,"theora",6)!=0)return TH_ENOTFORMAT;
  195. switch(packtype){
  196. /*Codec info header.*/
  197. case 0x80:{
  198. /*This should be the first packet, and we should not already be
  199. initialized.*/
  200. if(!_op->b_o_s||_info->frame_width>0)return TH_EBADHEADER;
  201. ret=oc_info_unpack(_opb,_info);
  202. if(ret<0)th_info_clear(_info);
  203. else ret=3;
  204. }break;
  205. /*Comment header.*/
  206. case 0x81:{
  207. if(_tc==NULL)return TH_EFAULT;
  208. /*We shoud have already decoded the info header, and should not yet have
  209. decoded the comment header.*/
  210. if(_info->frame_width==0||_tc->vendor!=NULL)return TH_EBADHEADER;
  211. ret=oc_comment_unpack(_opb,_tc);
  212. if(ret<0)th_comment_clear(_tc);
  213. else ret=2;
  214. }break;
  215. /*Codec setup header.*/
  216. case 0x82:{
  217. oc_setup_info *setup;
  218. if(_tc==NULL||_setup==NULL)return TH_EFAULT;
  219. /*We should have already decoded the info header and the comment header,
  220. and should not yet have decoded the setup header.*/
  221. if(_info->frame_width==0||_tc->vendor==NULL||*_setup!=NULL){
  222. return TH_EBADHEADER;
  223. }
  224. setup=(oc_setup_info *)_ogg_calloc(1,sizeof(*setup));
  225. if(setup==NULL)return TH_EFAULT;
  226. ret=oc_setup_unpack(_opb,setup);
  227. if(ret<0){
  228. oc_setup_clear(setup);
  229. _ogg_free(setup);
  230. }
  231. else{
  232. *_setup=setup;
  233. ret=1;
  234. }
  235. }break;
  236. default:{
  237. /*We don't know what this header is.*/
  238. return TH_EBADHEADER;
  239. }break;
  240. }
  241. return ret;
  242. }
  243. /*Decodes one header packet.
  244. This should be called repeatedly with the packets at the beginning of the
  245. stream until it returns 0.*/
  246. int th_decode_headerin(th_info *_info,th_comment *_tc,
  247. th_setup_info **_setup,ogg_packet *_op){
  248. oc_pack_buf opb;
  249. if(_op==NULL)return TH_EBADHEADER;
  250. if(_info==NULL)return TH_EFAULT;
  251. oc_pack_readinit(&opb,_op->packet,_op->bytes);
  252. return oc_dec_headerin(&opb,_info,_tc,_setup,_op);
  253. }
  254. void th_setup_free(th_setup_info *_setup){
  255. if(_setup!=NULL){
  256. oc_setup_clear(_setup);
  257. _ogg_free(_setup);
  258. }
  259. }