1 /*
2  * ASF compatible demuxer
3  * Copyright (c) 2000, 2001 Fabrice Bellard
4  *
5  * This file is part of FFmpeg.
6  *
7  * FFmpeg is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * FFmpeg is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with FFmpeg; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20  */
21 
22 #include <inttypes.h>
23 
24 #include "libavutil/attributes.h"
25 #include "libavutil/avassert.h"
26 #include "libavutil/avstring.h"
27 #include "libavutil/bswap.h"
28 #include "libavutil/common.h"
29 #include "libavutil/dict.h"
30 #include "libavutil/internal.h"
31 #include "libavutil/mathematics.h"
32 #include "libavutil/opt.h"
33 #include "avformat.h"
34 #include "avio_internal.h"
35 #include "avlanguage.h"
36 #include "demux.h"
37 #include "internal.h"
38 #include "riff.h"
39 #include "asf.h"
40 #include "asfcrypt.h"
41 
42 typedef struct ASFPayload {
43     uint8_t type;
44     uint16_t size;
45 } ASFPayload;
46 
47 typedef struct ASFStream {
48     int num;
49     unsigned char seq;
50     /* use for reading */
51     AVPacket pkt;
52     int frag_offset;
53     int packet_obj_size;
54     int timestamp;
55     int64_t duration;
56     int skip_to_key;
57     int pkt_clean;
58 
59     int ds_span;                /* descrambling  */
60     int ds_packet_size;
61     int ds_chunk_size;
62 
63     int64_t packet_pos;
64 
65     uint16_t stream_language_index;
66 
67     int      palette_changed;
68     uint32_t palette[256];
69 
70     int payload_ext_ct;
71     ASFPayload payload[8];
72 } ASFStream;
73 
74 typedef struct ASFContext {
75     const AVClass *class;
76     int asfid2avid[128];                 ///< conversion table from asf ID 2 AVStream ID
77     ASFStream streams[128];              ///< it's max number and it's not that big
78     uint32_t stream_bitrates[128];       ///< max number of streams, bitrate for each (for streaming)
79     AVRational dar[128];
80     char stream_languages[128][6];       ///< max number of streams, language for each (RFC1766, e.g. en-US)
81     /* non streamed additonnal info */
82     /* packet filling */
83     int packet_size_left;
84     /* only for reading */
85     uint64_t data_offset;                ///< beginning of the first data packet
86     uint64_t data_object_offset;         ///< data object offset (excl. GUID & size)
87     uint64_t data_object_size;           ///< size of the data object
88     int index_read;
89 
90     ASFMainHeader hdr;
91 
92     int packet_flags;
93     int packet_property;
94     int packet_timestamp;
95     int packet_segsizetype;
96     int packet_segments;
97     int packet_seq;
98     int packet_replic_size;
99     int packet_key_frame;
100     int packet_padsize;
101     unsigned int packet_frag_offset;
102     unsigned int packet_frag_size;
103     int64_t packet_frag_timestamp;
104     int ts_is_pts;
105     int packet_multi_size;
106     int packet_time_delta;
107     int64_t packet_time_start;
108     int64_t packet_pos;
109 
110     int stream_index;
111 
112     ASFStream *asf_st;                   ///< currently decoded stream
113 
114     int no_resync_search;
115     int export_xmp;
116 
117     int uses_std_ecc;
118 } ASFContext;
119 
120 static const AVOption options[] = {
121     { "no_resync_search", "Don't try to resynchronize by looking for a certain optional start code", offsetof(ASFContext, no_resync_search), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
122     { "export_xmp", "Export full XMP metadata", offsetof(ASFContext, export_xmp), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
123     { NULL },
124 };
125 
126 static const AVClass asf_class = {
127     .class_name = "asf demuxer",
128     .item_name  = av_default_item_name,
129     .option     = options,
130     .version    = LIBAVUTIL_VERSION_INT,
131 };
132 
133 #undef NDEBUG
134 #include <assert.h>
135 
136 #define ASF_MAX_STREAMS 127
137 #define FRAME_HEADER_SIZE 6
138 // Fix Me! FRAME_HEADER_SIZE may be different.
139 // (7 is known to be too large for GipsyGuitar.wmv)
140 
141 #ifdef DEBUG
142 static const ff_asf_guid stream_bitrate_guid = { /* (http://get.to/sdp) */
143     0xce, 0x75, 0xf8, 0x7b, 0x8d, 0x46, 0xd1, 0x11, 0x8d, 0x82, 0x00, 0x60, 0x97, 0xc9, 0xa2, 0xb2
144 };
145 
146 static const ff_asf_guid asf_audio_conceal_none = {
147     // 0x40, 0xa4, 0xf1, 0x49, 0x4ece, 0x11d0, 0xa3, 0xac, 0x00, 0xa0, 0xc9, 0x03, 0x48, 0xf6
148     // New value lifted from avifile
149     0x00, 0x57, 0xfb, 0x20, 0x55, 0x5B, 0xCF, 0x11, 0xa8, 0xfd, 0x00, 0x80, 0x5f, 0x5c, 0x44, 0x2b
150 };
151 
152 #define PRINT_IF_GUID(g, cmp) \
153     if (!ff_guidcmp(g, &(cmp))) \
154         av_log(NULL, AV_LOG_TRACE, "(GUID: %s) ", # cmp)
155 
print_guid(ff_asf_guid *g)156 static void print_guid(ff_asf_guid *g)
157 {
158     int i;
159     PRINT_IF_GUID(g, ff_asf_header);
160     else PRINT_IF_GUID(g, ff_asf_file_header);
161     else PRINT_IF_GUID(g, ff_asf_stream_header);
162     else PRINT_IF_GUID(g, ff_asf_audio_stream);
163     else PRINT_IF_GUID(g, asf_audio_conceal_none);
164     else PRINT_IF_GUID(g, ff_asf_video_stream);
165     else PRINT_IF_GUID(g, ff_asf_video_conceal_none);
166     else PRINT_IF_GUID(g, ff_asf_command_stream);
167     else PRINT_IF_GUID(g, ff_asf_comment_header);
168     else PRINT_IF_GUID(g, ff_asf_codec_comment_header);
169     else PRINT_IF_GUID(g, ff_asf_codec_comment1_header);
170     else PRINT_IF_GUID(g, ff_asf_data_header);
171     else PRINT_IF_GUID(g, ff_asf_simple_index_header);
172     else PRINT_IF_GUID(g, ff_asf_head1_guid);
173     else PRINT_IF_GUID(g, ff_asf_head2_guid);
174     else PRINT_IF_GUID(g, ff_asf_my_guid);
175     else PRINT_IF_GUID(g, ff_asf_ext_stream_header);
176     else PRINT_IF_GUID(g, ff_asf_extended_content_header);
177     else PRINT_IF_GUID(g, ff_asf_ext_stream_embed_stream_header);
178     else PRINT_IF_GUID(g, ff_asf_ext_stream_audio_stream);
179     else PRINT_IF_GUID(g, ff_asf_metadata_header);
180     else PRINT_IF_GUID(g, ff_asf_metadata_library_header);
181     else PRINT_IF_GUID(g, ff_asf_marker_header);
182     else PRINT_IF_GUID(g, stream_bitrate_guid);
183     else PRINT_IF_GUID(g, ff_asf_language_guid);
184     else
185         av_log(NULL, AV_LOG_TRACE, "(GUID: unknown) ");
186     for (i = 0; i < 16; i++)
187         av_log(NULL, AV_LOG_TRACE, " 0x%02x,", (*g)[i]);
188     av_log(NULL, AV_LOG_TRACE, "}\n");
189 }
190 #undef PRINT_IF_GUID
191 #else
192 #define print_guid(g) while(0)
193 #endif
194 
asf_probe(const AVProbeData *pd)195 static int asf_probe(const AVProbeData *pd)
196 {
197     /* check file header */
198     if (!ff_guidcmp(pd->buf, &ff_asf_header))
199         return AVPROBE_SCORE_MAX;
200     else
201         return 0;
202 }
203 
204 /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object"
205  * but 16 bit for "Metadata Object" and "Metadata Library Object" */
get_value(AVIOContext *pb, int type, int type2_size)206 static int get_value(AVIOContext *pb, int type, int type2_size)
207 {
208     switch (type) {
209     case ASF_BOOL:
210         return (type2_size == 32) ? avio_rl32(pb) : avio_rl16(pb);
211     case ASF_DWORD:
212         return avio_rl32(pb);
213     case ASF_QWORD:
214         return avio_rl64(pb);
215     case ASF_WORD:
216         return avio_rl16(pb);
217     default:
218         return INT_MIN;
219     }
220 }
221 
get_tag(AVFormatContext *s, const char *key, int type, int len, int type2_size)222 static void get_tag(AVFormatContext *s, const char *key, int type, int len, int type2_size)
223 {
224     ASFContext *asf = s->priv_data;
225     char *value = NULL;
226     int64_t off = avio_tell(s->pb);
227 #define LEN 22
228 
229     av_assert0((unsigned)len < (INT_MAX - LEN) / 2);
230 
231     if (!asf->export_xmp && !strncmp(key, "xmp", 3))
232         goto finish;
233 
234     value = av_malloc(2 * len + LEN);
235     if (!value)
236         goto finish;
237 
238     switch (type) {
239     case ASF_UNICODE:
240         avio_get_str16le(s->pb, len, value, 2 * len + 1);
241         break;
242     case -1: // ASCI
243         avio_read(s->pb, value, len);
244         value[len]=0;
245         break;
246     case ASF_BYTE_ARRAY:
247         if (ff_asf_handle_byte_array(s, key, len) > 0)
248             av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", key);
249         goto finish;
250     case ASF_BOOL:
251     case ASF_DWORD:
252     case ASF_QWORD:
253     case ASF_WORD: {
254         uint64_t num = get_value(s->pb, type, type2_size);
255         snprintf(value, LEN, "%"PRIu64, num);
256         break;
257     }
258     case ASF_GUID:
259         av_log(s, AV_LOG_DEBUG, "Unsupported GUID value in tag %s.\n", key);
260         goto finish;
261     default:
262         av_log(s, AV_LOG_DEBUG,
263                "Unsupported value type %d in tag %s.\n", type, key);
264         goto finish;
265     }
266     if (*value)
267         av_dict_set(&s->metadata, key, value, 0);
268 
269 finish:
270     av_freep(&value);
271     avio_seek(s->pb, off + len, SEEK_SET);
272 }
273 
asf_read_file_properties(AVFormatContext *s)274 static int asf_read_file_properties(AVFormatContext *s)
275 {
276     ASFContext *asf = s->priv_data;
277     AVIOContext *pb = s->pb;
278 
279     ff_get_guid(pb, &asf->hdr.guid);
280     asf->hdr.file_size   = avio_rl64(pb);
281     asf->hdr.create_time = avio_rl64(pb);
282     avio_rl64(pb);                               /* number of packets */
283     asf->hdr.play_time   = avio_rl64(pb);
284     asf->hdr.send_time   = avio_rl64(pb);
285     asf->hdr.preroll     = avio_rl32(pb);
286     asf->hdr.ignore      = avio_rl32(pb);
287     asf->hdr.flags       = avio_rl32(pb);
288     asf->hdr.min_pktsize = avio_rl32(pb);
289     asf->hdr.max_pktsize = avio_rl32(pb);
290     if (asf->hdr.min_pktsize >= (1U << 29))
291         return AVERROR_INVALIDDATA;
292     asf->hdr.max_bitrate = avio_rl32(pb);
293     s->packet_size       = asf->hdr.max_pktsize;
294 
295     return 0;
296 }
297 
asf_read_stream_properties(AVFormatContext *s, int64_t size)298 static int asf_read_stream_properties(AVFormatContext *s, int64_t size)
299 {
300     ASFContext *asf = s->priv_data;
301     AVIOContext *pb = s->pb;
302     AVStream *st;
303     FFStream *sti;
304     ASFStream *asf_st;
305     ff_asf_guid g;
306     enum AVMediaType type;
307     int type_specific_size, sizeX;
308     unsigned int tag1;
309     int64_t pos1, pos2, start_time;
310     int test_for_ext_stream_audio, is_dvr_ms_audio = 0;
311 
312     if (s->nb_streams == ASF_MAX_STREAMS) {
313         av_log(s, AV_LOG_ERROR, "too many streams\n");
314         return AVERROR(EINVAL);
315     }
316 
317     pos1 = avio_tell(pb);
318 
319     st = avformat_new_stream(s, NULL);
320     if (!st)
321         return AVERROR(ENOMEM);
322     sti = ffstream(st);
323     avpriv_set_pts_info(st, 32, 1, 1000); /* 32 bit pts in ms */
324     start_time     = asf->hdr.preroll;
325 
326     if (!(asf->hdr.flags & 0x01)) { // if we aren't streaming...
327         int64_t fsize = avio_size(pb);
328         if (fsize <= 0 || (int64_t)asf->hdr.file_size <= 0 ||
329             FFABS(fsize - (int64_t)asf->hdr.file_size) < FFMIN(fsize, asf->hdr.file_size)/20)
330             st->duration = asf->hdr.play_time /
331                        (10000000 / 1000) - start_time;
332     }
333     ff_get_guid(pb, &g);
334 
335     test_for_ext_stream_audio = 0;
336     if (!ff_guidcmp(&g, &ff_asf_audio_stream)) {
337         type = AVMEDIA_TYPE_AUDIO;
338     } else if (!ff_guidcmp(&g, &ff_asf_video_stream)) {
339         type = AVMEDIA_TYPE_VIDEO;
340     } else if (!ff_guidcmp(&g, &ff_asf_jfif_media)) {
341         type                = AVMEDIA_TYPE_VIDEO;
342         st->codecpar->codec_id = AV_CODEC_ID_MJPEG;
343     } else if (!ff_guidcmp(&g, &ff_asf_command_stream)) {
344         type = AVMEDIA_TYPE_DATA;
345     } else if (!ff_guidcmp(&g, &ff_asf_ext_stream_embed_stream_header)) {
346         test_for_ext_stream_audio = 1;
347         type                      = AVMEDIA_TYPE_UNKNOWN;
348     } else {
349         return -1;
350     }
351     ff_get_guid(pb, &g);
352     avio_skip(pb, 8); /* total_size */
353     type_specific_size = avio_rl32(pb);
354     avio_rl32(pb);
355     st->id = avio_rl16(pb) & 0x7f; /* stream id */
356     // mapping of asf ID to AV stream ID;
357     asf->asfid2avid[st->id] = s->nb_streams - 1;
358     asf_st = &asf->streams[st->id];
359 
360     avio_rl32(pb);
361 
362     if (test_for_ext_stream_audio) {
363         ff_get_guid(pb, &g);
364         if (!ff_guidcmp(&g, &ff_asf_ext_stream_audio_stream)) {
365             type            = AVMEDIA_TYPE_AUDIO;
366             is_dvr_ms_audio = 1;
367             ff_get_guid(pb, &g);
368             avio_rl32(pb);
369             avio_rl32(pb);
370             avio_rl32(pb);
371             ff_get_guid(pb, &g);
372             avio_rl32(pb);
373         }
374     }
375 
376     st->codecpar->codec_type = type;
377     if (type == AVMEDIA_TYPE_AUDIO) {
378         int ret = ff_get_wav_header(s, pb, st->codecpar, type_specific_size, 0);
379         if (ret < 0)
380             return ret;
381         if (is_dvr_ms_audio) {
382             // codec_id and codec_tag are unreliable in dvr_ms
383             // files. Set them later by probing stream.
384             sti->request_probe = 1;
385             st->codecpar->codec_tag = 0;
386         }
387         if (st->codecpar->codec_id == AV_CODEC_ID_AAC)
388             sti->need_parsing = AVSTREAM_PARSE_NONE;
389         else
390             sti->need_parsing = AVSTREAM_PARSE_FULL;
391         /* We have to init the frame size at some point .... */
392         pos2 = avio_tell(pb);
393         if (size >= (pos2 + 8 - pos1 + 24)) {
394             asf_st->ds_span        = avio_r8(pb);
395             asf_st->ds_packet_size = avio_rl16(pb);
396             asf_st->ds_chunk_size  = avio_rl16(pb);
397             avio_rl16(pb);  // ds_data_size
398             avio_r8(pb);    // ds_silence_data
399         }
400         if (asf_st->ds_span > 1) {
401             if (!asf_st->ds_chunk_size                                ||
402                 (asf_st->ds_packet_size / asf_st->ds_chunk_size <= 1) ||
403                 asf_st->ds_packet_size % asf_st->ds_chunk_size)
404                 asf_st->ds_span = 0;  // disable descrambling
405         }
406     } else if (type == AVMEDIA_TYPE_VIDEO &&
407                size - (avio_tell(pb) - pos1 + 24) >= 51) {
408         avio_rl32(pb);
409         avio_rl32(pb);
410         avio_r8(pb);
411         avio_rl16(pb);        /* size */
412         sizeX             = avio_rl32(pb); /* size */
413         st->codecpar->width  = avio_rl32(pb);
414         st->codecpar->height = avio_rl32(pb);
415         /* not available for asf */
416         avio_rl16(pb); /* panes */
417         st->codecpar->bits_per_coded_sample = avio_rl16(pb); /* depth */
418         tag1                             = avio_rl32(pb);
419         avio_skip(pb, 20);
420         if (sizeX > 40) {
421             if (size < sizeX - 40 || sizeX - 40 > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
422                 return AVERROR_INVALIDDATA;
423             st->codecpar->extradata_size = ffio_limit(pb, sizeX - 40);
424             st->codecpar->extradata      = av_mallocz(st->codecpar->extradata_size +
425                                                    AV_INPUT_BUFFER_PADDING_SIZE);
426             if (!st->codecpar->extradata)
427                 return AVERROR(ENOMEM);
428             avio_read(pb, st->codecpar->extradata, st->codecpar->extradata_size);
429         }
430 
431         /* Extract palette from extradata if bpp <= 8 */
432         /* This code assumes that extradata contains only palette */
433         /* This is true for all paletted codecs implemented in libavcodec */
434         if (st->codecpar->extradata_size && (st->codecpar->bits_per_coded_sample <= 8)) {
435 #if HAVE_BIGENDIAN
436             int i;
437             for (i = 0; i < FFMIN(st->codecpar->extradata_size, AVPALETTE_SIZE) / 4; i++)
438                 asf_st->palette[i] = av_bswap32(((uint32_t *)st->codecpar->extradata)[i]);
439 #else
440             memcpy(asf_st->palette, st->codecpar->extradata,
441                    FFMIN(st->codecpar->extradata_size, AVPALETTE_SIZE));
442 #endif
443             asf_st->palette_changed = 1;
444         }
445 
446         st->codecpar->codec_tag = tag1;
447         st->codecpar->codec_id  = ff_codec_get_id(ff_codec_bmp_tags, tag1);
448         if (tag1 == MKTAG('D', 'V', 'R', ' ')) {
449             sti->need_parsing = AVSTREAM_PARSE_FULL;
450             /* issue658 contains wrong w/h and MS even puts a fake seq header
451              * with wrong w/h in extradata while a correct one is in the stream.
452              * maximum lameness */
453             st->codecpar->width      =
454                 st->codecpar->height = 0;
455             av_freep(&st->codecpar->extradata);
456             st->codecpar->extradata_size = 0;
457         }
458         if (st->codecpar->codec_id == AV_CODEC_ID_H264)
459             sti->need_parsing = AVSTREAM_PARSE_FULL_ONCE;
460         if (st->codecpar->codec_id == AV_CODEC_ID_MPEG4)
461             sti->need_parsing = AVSTREAM_PARSE_FULL_ONCE;
462     }
463     pos2 = avio_tell(pb);
464     avio_skip(pb, size - (pos2 - pos1 + 24));
465 
466     return 0;
467 }
468 
asf_read_ext_stream_properties(AVFormatContext *s)469 static int asf_read_ext_stream_properties(AVFormatContext *s)
470 {
471     ASFContext *asf = s->priv_data;
472     AVIOContext *pb = s->pb;
473     ff_asf_guid g;
474     int ext_len, payload_ext_ct, stream_ct, i;
475     uint32_t leak_rate, stream_num;
476     unsigned int stream_languageid_index;
477 
478     avio_rl64(pb); // starttime
479     avio_rl64(pb); // endtime
480     leak_rate = avio_rl32(pb); // leak-datarate
481     avio_rl32(pb); // bucket-datasize
482     avio_rl32(pb); // init-bucket-fullness
483     avio_rl32(pb); // alt-leak-datarate
484     avio_rl32(pb); // alt-bucket-datasize
485     avio_rl32(pb); // alt-init-bucket-fullness
486     avio_rl32(pb); // max-object-size
487     avio_rl32(pb); // flags (reliable,seekable,no_cleanpoints?,resend-live-cleanpoints, rest of bits reserved)
488     stream_num = avio_rl16(pb); // stream-num
489 
490     stream_languageid_index = avio_rl16(pb); // stream-language-id-index
491     if (stream_num < 128)
492         asf->streams[stream_num].stream_language_index = stream_languageid_index;
493 
494     avio_rl64(pb); // avg frametime in 100ns units
495     stream_ct      = avio_rl16(pb); // stream-name-count
496     payload_ext_ct = avio_rl16(pb); // payload-extension-system-count
497 
498     if (stream_num < 128) {
499         asf->stream_bitrates[stream_num] = leak_rate;
500         asf->streams[stream_num].payload_ext_ct = 0;
501     }
502 
503     for (i = 0; i < stream_ct; i++) {
504         avio_rl16(pb);
505         ext_len = avio_rl16(pb);
506         avio_skip(pb, ext_len);
507     }
508 
509     for (i = 0; i < payload_ext_ct; i++) {
510         int size;
511         ff_get_guid(pb, &g);
512         size = avio_rl16(pb);
513         ext_len = avio_rl32(pb);
514         if (ext_len < 0)
515             return AVERROR_INVALIDDATA;
516         avio_skip(pb, ext_len);
517         if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) {
518             ASFPayload *p = &asf->streams[stream_num].payload[i];
519             p->type = g[0];
520             p->size = size;
521             av_log(s, AV_LOG_DEBUG, "Payload extension %x %d\n", g[0], p->size );
522             asf->streams[stream_num].payload_ext_ct ++;
523         }
524     }
525 
526     return 0;
527 }
528 
asf_read_content_desc(AVFormatContext *s)529 static int asf_read_content_desc(AVFormatContext *s)
530 {
531     AVIOContext *pb = s->pb;
532     int len1, len2, len3, len4, len5;
533 
534     len1 = avio_rl16(pb);
535     len2 = avio_rl16(pb);
536     len3 = avio_rl16(pb);
537     len4 = avio_rl16(pb);
538     len5 = avio_rl16(pb);
539     get_tag(s, "title", 0, len1, 32);
540     get_tag(s, "author", 0, len2, 32);
541     get_tag(s, "copyright", 0, len3, 32);
542     get_tag(s, "comment", 0, len4, 32);
543     avio_skip(pb, len5);
544 
545     return 0;
546 }
547 
asf_read_ext_content_desc(AVFormatContext *s)548 static int asf_read_ext_content_desc(AVFormatContext *s)
549 {
550     AVIOContext *pb = s->pb;
551     ASFContext *asf = s->priv_data;
552     int desc_count, i, ret;
553 
554     desc_count = avio_rl16(pb);
555     for (i = 0; i < desc_count; i++) {
556         int name_len, value_type, value_len;
557         char name[1024];
558 
559         name_len = avio_rl16(pb);
560         if (name_len % 2)   // must be even, broken lavf versions wrote len-1
561             name_len += 1;
562         if ((ret = avio_get_str16le(pb, name_len, name, sizeof(name))) < name_len)
563             avio_skip(pb, name_len - ret);
564         value_type = avio_rl16(pb);
565         value_len  = avio_rl16(pb);
566         if (!value_type && value_len % 2)
567             value_len += 1;
568         /* My sample has that stream set to 0 maybe that mean the container.
569          * ASF stream count starts at 1. I am using 0 to the container value
570          * since it's unused. */
571         if (!strcmp(name, "AspectRatioX"))
572             asf->dar[0].num = get_value(s->pb, value_type, 32);
573         else if (!strcmp(name, "AspectRatioY"))
574             asf->dar[0].den = get_value(s->pb, value_type, 32);
575         else
576             get_tag(s, name, value_type, value_len, 32);
577     }
578 
579     return 0;
580 }
581 
asf_read_language_list(AVFormatContext *s)582 static int asf_read_language_list(AVFormatContext *s)
583 {
584     AVIOContext *pb = s->pb;
585     ASFContext *asf = s->priv_data;
586     int j, ret;
587     int stream_count = avio_rl16(pb);
588     for (j = 0; j < stream_count; j++) {
589         char lang[6];
590         unsigned int lang_len = avio_r8(pb);
591         if ((ret = avio_get_str16le(pb, lang_len, lang,
592                                     sizeof(lang))) < lang_len)
593             avio_skip(pb, lang_len - ret);
594         if (j < 128)
595             av_strlcpy(asf->stream_languages[j], lang,
596                        sizeof(*asf->stream_languages));
597     }
598 
599     return 0;
600 }
601 
asf_read_metadata(AVFormatContext *s)602 static int asf_read_metadata(AVFormatContext *s)
603 {
604     AVIOContext *pb = s->pb;
605     ASFContext *asf = s->priv_data;
606     int n, stream_num, name_len_utf16, name_len_utf8, value_len;
607     int ret, i;
608     n = avio_rl16(pb);
609 
610     for (i = 0; i < n; i++) {
611         uint8_t *name;
612         int value_type;
613 
614         avio_rl16(pb);  // lang_list_index
615         stream_num = avio_rl16(pb);
616         name_len_utf16 = avio_rl16(pb);
617         value_type = avio_rl16(pb); /* value_type */
618         value_len  = avio_rl32(pb);
619 
620         if (value_len < 0 || value_len > UINT16_MAX)
621             return AVERROR_INVALIDDATA;
622 
623         name_len_utf8 = 2*name_len_utf16 + 1;
624         name          = av_malloc(name_len_utf8);
625         if (!name)
626             return AVERROR(ENOMEM);
627 
628         if ((ret = avio_get_str16le(pb, name_len_utf16, name, name_len_utf8)) < name_len_utf16)
629             avio_skip(pb, name_len_utf16 - ret);
630         av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n",
631                 i, stream_num, name_len_utf16, value_type, value_len, name);
632 
633         if (!strcmp(name, "AspectRatioX")){
634             int aspect_x = get_value(s->pb, value_type, 16);
635             if(stream_num < 128)
636                 asf->dar[stream_num].num = aspect_x;
637         } else if(!strcmp(name, "AspectRatioY")){
638             int aspect_y = get_value(s->pb, value_type, 16);
639             if(stream_num < 128)
640                 asf->dar[stream_num].den = aspect_y;
641         } else {
642             get_tag(s, name, value_type, value_len, 16);
643         }
644         av_freep(&name);
645     }
646 
647     return 0;
648 }
649 
asf_read_marker(AVFormatContext *s)650 static int asf_read_marker(AVFormatContext *s)
651 {
652     AVIOContext *pb = s->pb;
653     ASFContext *asf = s->priv_data;
654     int i, count, name_len, ret;
655     char name[1024];
656 
657     avio_rl64(pb);            // reserved 16 bytes
658     avio_rl64(pb);            // ...
659     count = avio_rl32(pb);    // markers count
660     avio_rl16(pb);            // reserved 2 bytes
661     name_len = avio_rl16(pb); // name length
662     avio_skip(pb, name_len);
663 
664     for (i = 0; i < count; i++) {
665         int64_t pres_time;
666         int name_len;
667 
668         if (avio_feof(pb))
669             return AVERROR_INVALIDDATA;
670 
671         avio_rl64(pb);             // offset, 8 bytes
672         pres_time = avio_rl64(pb); // presentation time
673         pres_time = av_sat_sub64(pres_time, asf->hdr.preroll * 10000LL);
674         avio_rl16(pb);             // entry length
675         avio_rl32(pb);             // send time
676         avio_rl32(pb);             // flags
677         name_len = avio_rl32(pb);  // name length
678         if ((unsigned)name_len > INT_MAX / 2)
679             return AVERROR_INVALIDDATA;
680         if ((ret = avio_get_str16le(pb, name_len * 2, name,
681                                     sizeof(name))) < name_len)
682             avio_skip(pb, name_len - ret);
683         avpriv_new_chapter(s, i, (AVRational) { 1, 10000000 }, pres_time,
684                            AV_NOPTS_VALUE, name);
685     }
686 
687     return 0;
688 }
689 
asf_read_header(AVFormatContext *s)690 static int asf_read_header(AVFormatContext *s)
691 {
692     ASFContext *asf = s->priv_data;
693     ff_asf_guid g;
694     AVIOContext *pb = s->pb;
695     int i;
696     int64_t gsize;
697 
698     ff_get_guid(pb, &g);
699     if (ff_guidcmp(&g, &ff_asf_header))
700         return AVERROR_INVALIDDATA;
701     avio_rl64(pb);
702     avio_rl32(pb);
703     avio_r8(pb);
704     avio_r8(pb);
705     memset(&asf->asfid2avid, -1, sizeof(asf->asfid2avid));
706 
707     for (i = 0; i<128; i++)
708         asf->streams[i].stream_language_index = 128; // invalid stream index means no language info
709 
710     for (;;) {
711         uint64_t gpos = avio_tell(pb);
712         int ret = 0;
713         ff_get_guid(pb, &g);
714         gsize = avio_rl64(pb);
715         print_guid(&g);
716         if (!ff_guidcmp(&g, &ff_asf_data_header)) {
717             asf->data_object_offset = avio_tell(pb);
718             /* If not streaming, gsize is not unlimited (how?),
719              * and there is enough space in the file.. */
720             if (!(asf->hdr.flags & 0x01) && gsize >= 100)
721                 asf->data_object_size = gsize - 24;
722             else
723                 asf->data_object_size = (uint64_t)-1;
724             break;
725         }
726         if (gsize < 24)
727             return AVERROR_INVALIDDATA;
728         if (!ff_guidcmp(&g, &ff_asf_file_header)) {
729             ret = asf_read_file_properties(s);
730         } else if (!ff_guidcmp(&g, &ff_asf_stream_header)) {
731             ret = asf_read_stream_properties(s, gsize);
732         } else if (!ff_guidcmp(&g, &ff_asf_comment_header)) {
733             asf_read_content_desc(s);
734         } else if (!ff_guidcmp(&g, &ff_asf_language_guid)) {
735             asf_read_language_list(s);
736         } else if (!ff_guidcmp(&g, &ff_asf_extended_content_header)) {
737             asf_read_ext_content_desc(s);
738         } else if (!ff_guidcmp(&g, &ff_asf_metadata_header)) {
739             asf_read_metadata(s);
740         } else if (!ff_guidcmp(&g, &ff_asf_metadata_library_header)) {
741             asf_read_metadata(s);
742         } else if (!ff_guidcmp(&g, &ff_asf_ext_stream_header)) {
743             asf_read_ext_stream_properties(s);
744 
745             // there could be an optional stream properties object to follow
746             // if so the next iteration will pick it up
747             continue;
748         } else if (!ff_guidcmp(&g, &ff_asf_head1_guid)) {
749             ff_get_guid(pb, &g);
750             avio_skip(pb, 6);
751             continue;
752         } else if (!ff_guidcmp(&g, &ff_asf_marker_header)) {
753             asf_read_marker(s);
754         } else if (avio_feof(pb)) {
755             return AVERROR_EOF;
756         } else {
757             if (!s->keylen) {
758                 if (!ff_guidcmp(&g, &ff_asf_content_encryption)) {
759                     AVPacket *const pkt = ffformatcontext(s)->parse_pkt;
760                     unsigned int len;
761                     av_log(s, AV_LOG_WARNING,
762                            "DRM protected stream detected, decoding will likely fail!\n");
763                     len= avio_rl32(pb);
764                     av_log(s, AV_LOG_DEBUG, "Secret data:\n");
765 
766                     if ((ret = av_get_packet(pb, pkt, len)) < 0)
767                         return ret;
768                     av_hex_dump_log(s, AV_LOG_DEBUG, pkt->data, pkt->size);
769                     av_packet_unref(pkt);
770 
771                     len= avio_rl32(pb);
772                     if (len > UINT16_MAX)
773                         return AVERROR_INVALIDDATA;
774                     get_tag(s, "ASF_Protection_Type", -1, len, 32);
775 
776                     len= avio_rl32(pb);
777                     if (len > UINT16_MAX)
778                         return AVERROR_INVALIDDATA;
779                     get_tag(s, "ASF_Key_ID", -1, len, 32);
780 
781                     len= avio_rl32(pb);
782                     if (len > UINT16_MAX)
783                         return AVERROR_INVALIDDATA;
784                     get_tag(s, "ASF_License_URL", -1, len, 32);
785                 } else if (!ff_guidcmp(&g, &ff_asf_ext_content_encryption)) {
786                     av_log(s, AV_LOG_WARNING,
787                            "Ext DRM protected stream detected, decoding will likely fail!\n");
788                     av_dict_set(&s->metadata, "encryption", "ASF Extended Content Encryption", 0);
789                 } else if (!ff_guidcmp(&g, &ff_asf_digital_signature)) {
790                     av_log(s, AV_LOG_INFO, "Digital signature detected!\n");
791                 }
792             }
793         }
794         if (ret < 0)
795             return ret;
796 
797         if (avio_tell(pb) != gpos + gsize)
798             av_log(s, AV_LOG_DEBUG,
799                    "gpos mismatch our pos=%"PRIu64", end=%"PRId64"\n",
800                    avio_tell(pb) - gpos, gsize);
801         avio_seek(pb, gpos + gsize, SEEK_SET);
802     }
803     ff_get_guid(pb, &g);
804     avio_rl64(pb);
805     avio_r8(pb);
806     avio_r8(pb);
807     if (avio_feof(pb))
808         return AVERROR_EOF;
809     asf->data_offset      = avio_tell(pb);
810     asf->packet_size_left = 0;
811 
812     for (i = 0; i < 128; i++) {
813         int stream_num = asf->asfid2avid[i];
814         if (stream_num >= 0) {
815             AVStream *st = s->streams[stream_num];
816             if (!st->codecpar->bit_rate)
817                 st->codecpar->bit_rate = asf->stream_bitrates[i];
818             if (asf->dar[i].num > 0 && asf->dar[i].den > 0) {
819                 av_reduce(&st->sample_aspect_ratio.num,
820                           &st->sample_aspect_ratio.den,
821                           asf->dar[i].num, asf->dar[i].den, INT_MAX);
822             } else if ((asf->dar[0].num > 0) && (asf->dar[0].den > 0) &&
823                        // Use ASF container value if the stream doesn't set AR.
824                        (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO))
825                 av_reduce(&st->sample_aspect_ratio.num,
826                           &st->sample_aspect_ratio.den,
827                           asf->dar[0].num, asf->dar[0].den, INT_MAX);
828 
829             av_log(s, AV_LOG_TRACE, "i=%d, st->codecpar->codec_type:%d, asf->dar %d:%d sar=%d:%d\n",
830                     i, st->codecpar->codec_type, asf->dar[i].num, asf->dar[i].den,
831                     st->sample_aspect_ratio.num, st->sample_aspect_ratio.den);
832 
833             // copy and convert language codes to the frontend
834             if (asf->streams[i].stream_language_index < 128) {
835                 const char *rfc1766 = asf->stream_languages[asf->streams[i].stream_language_index];
836                 if (rfc1766 && strlen(rfc1766) > 1) {
837                     const char primary_tag[3] = { rfc1766[0], rfc1766[1], '\0' }; // ignore country code if any
838                     const char *iso6392       = ff_convert_lang_to(primary_tag,
839                                                                    AV_LANG_ISO639_2_BIBL);
840                     if (iso6392)
841                         av_dict_set(&st->metadata, "language", iso6392, 0);
842                 }
843             }
844         }
845     }
846 
847     ff_metadata_conv(&s->metadata, NULL, ff_asf_metadata_conv);
848 
849     return 0;
850 }
851 
852 #define DO_2BITS(bits, var, defval)             \
853     switch (bits & 3) {                         \
854     case 3:                                     \
855         var = avio_rl32(pb);                    \
856         rsize += 4;                             \
857         break;                                  \
858     case 2:                                     \
859         var = avio_rl16(pb);                    \
860         rsize += 2;                             \
861         break;                                  \
862     case 1:                                     \
863         var = avio_r8(pb);                      \
864         rsize++;                                \
865         break;                                  \
866     default:                                    \
867         var = defval;                           \
868         break;                                  \
869     }
870 
871 /**
872  * Load a single ASF packet into the demuxer.
873  * @param s demux context
874  * @param pb context to read data from
875  * @return 0 on success, <0 on error
876  */
asf_get_packet(AVFormatContext *s, AVIOContext *pb)877 static int asf_get_packet(AVFormatContext *s, AVIOContext *pb)
878 {
879     ASFContext *asf = s->priv_data;
880     uint32_t packet_length, padsize;
881     int rsize = 8;
882     int c, d, e, off;
883 
884     if (asf->uses_std_ecc > 0) {
885         // if we do not know packet size, allow skipping up to 32 kB
886         off = 32768;
887         if (asf->no_resync_search)
888             off = 3;
889 //         else if (s->packet_size > 0 && !asf->uses_std_ecc)
890 //             off = (avio_tell(pb) - ffformatcontext(s)->data_offset) % s->packet_size + 3;
891 
892         c = d = e = -1;
893         while (off-- > 0) {
894             c = d;
895             d = e;
896             e = avio_r8(pb);
897             if (c == 0x82 && !d && !e)
898                 break;
899         }
900 
901         if (c != 0x82) {
902             /* This code allows handling of -EAGAIN at packet boundaries (i.e.
903             * if the packet sync code above triggers -EAGAIN). This does not
904             * imply complete -EAGAIN handling support at random positions in
905             * the stream. */
906             if (pb->error == AVERROR(EAGAIN))
907                 return AVERROR(EAGAIN);
908             if (!avio_feof(pb))
909                 av_log(s, AV_LOG_ERROR,
910                     "ff asf bad header %x  at:%"PRId64"\n", c, avio_tell(pb));
911         }
912         if ((c & 0x8f) == 0x82) {
913             if (d || e) {
914                 if (!avio_feof(pb))
915                     av_log(s, AV_LOG_ERROR, "ff asf bad non zero\n");
916                 return AVERROR_INVALIDDATA;
917             }
918             c      = avio_r8(pb);
919             d      = avio_r8(pb);
920             rsize += 3;
921         } else if(!avio_feof(pb)) {
922             avio_seek(pb, -1, SEEK_CUR); // FIXME
923         }
924     } else {
925         c = avio_r8(pb);
926         if (c & 0x80) {
927             rsize ++;
928             if (!(c & 0x60)) {
929                 d = avio_r8(pb);
930                 e = avio_r8(pb);
931                 avio_seek(pb, (c & 0xF) - 2, SEEK_CUR);
932                 rsize += c & 0xF;
933             }
934 
935             if (c != 0x82)
936                 avpriv_request_sample(s, "Invalid ECC byte");
937 
938             if (!asf->uses_std_ecc)
939                 asf->uses_std_ecc =  (c == 0x82 && !d && !e) ? 1 : -1;
940 
941             c = avio_r8(pb);
942         } else
943             asf->uses_std_ecc =  -1;
944         d = avio_r8(pb);
945     }
946 
947     asf->packet_flags    = c;
948     asf->packet_property = d;
949 
950     DO_2BITS(asf->packet_flags >> 5, packet_length, s->packet_size);
951     DO_2BITS(asf->packet_flags >> 1, padsize, 0); // sequence ignored
952     DO_2BITS(asf->packet_flags >> 3, padsize, 0); // padding length
953 
954     // the following checks prevent overflows and infinite loops
955     if (!packet_length || packet_length >= (1U << 29)) {
956         av_log(s, AV_LOG_ERROR,
957                "invalid packet_length %"PRIu32" at:%"PRId64"\n",
958                packet_length, avio_tell(pb));
959         return AVERROR_INVALIDDATA;
960     }
961     if (padsize >= packet_length) {
962         av_log(s, AV_LOG_ERROR,
963                "invalid padsize %"PRIu32" at:%"PRId64"\n", padsize, avio_tell(pb));
964         return AVERROR_INVALIDDATA;
965     }
966 
967     asf->packet_timestamp = avio_rl32(pb);
968     avio_rl16(pb); /* duration */
969     // rsize has at least 11 bytes which have to be present
970 
971     if (asf->packet_flags & 0x01) {
972         asf->packet_segsizetype = avio_r8(pb);
973         rsize++;
974         asf->packet_segments = asf->packet_segsizetype & 0x3f;
975     } else {
976         asf->packet_segments    = 1;
977         asf->packet_segsizetype = 0x80;
978     }
979     if (rsize > packet_length - padsize) {
980         asf->packet_size_left = 0;
981         av_log(s, AV_LOG_ERROR,
982                "invalid packet header length %d for pktlen %"PRIu32"-%"PRIu32" at %"PRId64"\n",
983                rsize, packet_length, padsize, avio_tell(pb));
984         return AVERROR_INVALIDDATA;
985     }
986     asf->packet_size_left = packet_length - padsize - rsize;
987     if (packet_length < asf->hdr.min_pktsize)
988         padsize += asf->hdr.min_pktsize - packet_length;
989     asf->packet_padsize = padsize;
990     av_log(s, AV_LOG_TRACE, "packet: size=%d padsize=%d  left=%d\n",
991             s->packet_size, asf->packet_padsize, asf->packet_size_left);
992     return 0;
993 }
994 
995 /**
996  *
997  * @return <0 if error
998  */
asf_read_frame_header(AVFormatContext *s, AVIOContext *pb)999 static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb)
1000 {
1001     ASFContext *asf = s->priv_data;
1002     ASFStream *asfst;
1003     int rsize       = 1;
1004     int num         = avio_r8(pb);
1005     int i;
1006     int64_t ts0, ts1 av_unused;
1007 
1008     asf->packet_segments--;
1009     asf->packet_key_frame = num >> 7;
1010     asf->stream_index     = asf->asfid2avid[num & 0x7f];
1011     asfst                 = &asf->streams[num & 0x7f];
1012     // sequence should be ignored!
1013     DO_2BITS(asf->packet_property >> 4, asf->packet_seq, 0);
1014     DO_2BITS(asf->packet_property >> 2, asf->packet_frag_offset, 0);
1015     DO_2BITS(asf->packet_property, asf->packet_replic_size, 0);
1016     av_log(asf, AV_LOG_TRACE, "key:%d stream:%d seq:%d offset:%d replic_size:%d num:%X packet_property %X\n",
1017             asf->packet_key_frame, asf->stream_index, asf->packet_seq,
1018             asf->packet_frag_offset, asf->packet_replic_size, num, asf->packet_property);
1019     if (rsize+(int64_t)asf->packet_replic_size > asf->packet_size_left) {
1020         av_log(s, AV_LOG_ERROR, "packet_replic_size %d is invalid\n", asf->packet_replic_size);
1021         return AVERROR_INVALIDDATA;
1022     }
1023     if (asf->packet_replic_size >= 8) {
1024         int64_t end = avio_tell(pb) + asf->packet_replic_size;
1025         AVRational aspect;
1026         asfst->packet_obj_size = avio_rl32(pb);
1027         if (asfst->packet_obj_size >= (1 << 24) || asfst->packet_obj_size < 0) {
1028             av_log(s, AV_LOG_ERROR, "packet_obj_size %d invalid\n", asfst->packet_obj_size);
1029             asfst->packet_obj_size = 0;
1030             return AVERROR_INVALIDDATA;
1031         }
1032         asf->packet_frag_timestamp = avio_rl32(pb); // timestamp
1033 
1034         for (i = 0; i < asfst->payload_ext_ct; i++) {
1035             ASFPayload *p = &asfst->payload[i];
1036             int size = p->size;
1037             int64_t payend;
1038             if (size == 0xFFFF)
1039                 size = avio_rl16(pb);
1040             payend = avio_tell(pb) + size;
1041             if (payend > end) {
1042                 av_log(s, AV_LOG_ERROR, "too long payload\n");
1043                 break;
1044             }
1045             switch (p->type) {
1046             case 0x50:
1047 //              duration = avio_rl16(pb);
1048                 break;
1049             case 0x54:
1050                 aspect.num = avio_r8(pb);
1051                 aspect.den = avio_r8(pb);
1052                 if (aspect.num > 0 && aspect.den > 0 && asf->stream_index >= 0) {
1053                     s->streams[asf->stream_index]->sample_aspect_ratio = aspect;
1054                 }
1055                 break;
1056             case 0x2A:
1057                 avio_skip(pb, 8);
1058                 ts0 = avio_rl64(pb);
1059                 ts1 = avio_rl64(pb);
1060                 if (ts0!= -1) asf->packet_frag_timestamp = ts0/10000;
1061                 else          asf->packet_frag_timestamp = AV_NOPTS_VALUE;
1062                 asf->ts_is_pts = 1;
1063                 break;
1064             case 0x5B:
1065             case 0xB7:
1066             case 0xCC:
1067             case 0xC0:
1068             case 0xA0:
1069                 //unknown
1070                 break;
1071             }
1072             avio_seek(pb, payend, SEEK_SET);
1073         }
1074 
1075         avio_seek(pb, end, SEEK_SET);
1076         rsize += asf->packet_replic_size; // FIXME - check validity
1077     } else if (asf->packet_replic_size == 1) {
1078         // multipacket - frag_offset is beginning timestamp
1079         asf->packet_time_start     = asf->packet_frag_offset;
1080         asf->packet_frag_offset    = 0;
1081         asf->packet_frag_timestamp = asf->packet_timestamp;
1082 
1083         asf->packet_time_delta = avio_r8(pb);
1084         rsize++;
1085     } else if (asf->packet_replic_size != 0) {
1086         av_log(s, AV_LOG_ERROR, "unexpected packet_replic_size of %d\n",
1087                asf->packet_replic_size);
1088         return AVERROR_INVALIDDATA;
1089     }
1090     if (asf->packet_flags & 0x01) {
1091         DO_2BITS(asf->packet_segsizetype >> 6, asf->packet_frag_size, 0); // 0 is illegal
1092         if (rsize > asf->packet_size_left) {
1093             av_log(s, AV_LOG_ERROR, "packet_replic_size is invalid\n");
1094             return AVERROR_INVALIDDATA;
1095         } else if (asf->packet_frag_size > asf->packet_size_left - rsize) {
1096             if (asf->packet_frag_size > asf->packet_size_left - rsize + asf->packet_padsize) {
1097                 av_log(s, AV_LOG_ERROR, "packet_frag_size is invalid (%d>%d-%d+%d)\n",
1098                        asf->packet_frag_size, asf->packet_size_left, rsize, asf->packet_padsize);
1099                 return AVERROR_INVALIDDATA;
1100             } else {
1101                 int diff = asf->packet_frag_size - (asf->packet_size_left - rsize);
1102                 asf->packet_size_left += diff;
1103                 asf->packet_padsize   -= diff;
1104             }
1105         }
1106     } else {
1107         asf->packet_frag_size = asf->packet_size_left - rsize;
1108     }
1109     if (asf->packet_replic_size == 1) {
1110         asf->packet_multi_size = asf->packet_frag_size;
1111         if (asf->packet_multi_size > asf->packet_size_left)
1112             return AVERROR_INVALIDDATA;
1113     }
1114     asf->packet_size_left -= rsize;
1115 
1116     return 0;
1117 }
1118 
1119 /**
1120  * Parse data from individual ASF packets (which were previously loaded
1121  * with asf_get_packet()).
1122  * @param s demux context
1123  * @param pb context to read data from
1124  * @param pkt pointer to store packet data into
1125  * @return 0 if data was stored in pkt, <0 on error or 1 if more ASF
1126  *          packets need to be loaded (through asf_get_packet())
1127  */
asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)1128 static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
1129 {
1130     ASFContext *asf   = s->priv_data;
1131     ASFStream *asf_st = 0;
1132     for (;;) {
1133         int ret;
1134         if (avio_feof(pb))
1135             return AVERROR_EOF;
1136         if (asf->packet_size_left < FRAME_HEADER_SIZE ||
1137             asf->packet_segments < 1 && asf->packet_time_start == 0) {
1138             int ret = asf->packet_size_left + asf->packet_padsize;
1139 
1140             if (asf->packet_size_left && asf->packet_size_left < FRAME_HEADER_SIZE)
1141                 av_log(s, AV_LOG_WARNING, "Skip due to FRAME_HEADER_SIZE\n");
1142 
1143             assert(ret >= 0);
1144             /* fail safe */
1145             avio_skip(pb, ret);
1146 
1147             asf->packet_pos = avio_tell(pb);
1148             if (asf->data_object_size != (uint64_t)-1 &&
1149                 (asf->packet_pos - asf->data_object_offset >= asf->data_object_size))
1150                 return AVERROR_EOF;  /* Do not exceed the size of the data object */
1151             return 1;
1152         }
1153         if (asf->packet_time_start == 0) {
1154             if (asf_read_frame_header(s, pb) < 0) {
1155                 asf->packet_time_start = asf->packet_segments = 0;
1156                 continue;
1157             }
1158             if (asf->stream_index < 0 ||
1159                 s->streams[asf->stream_index]->discard >= AVDISCARD_ALL ||
1160                 (!asf->packet_key_frame &&
1161                  (s->streams[asf->stream_index]->discard >= AVDISCARD_NONKEY || asf->streams[s->streams[asf->stream_index]->id].skip_to_key))) {
1162                 asf->packet_time_start = 0;
1163                 /* unhandled packet (should not happen) */
1164                 avio_skip(pb, asf->packet_frag_size);
1165                 asf->packet_size_left -= asf->packet_frag_size;
1166                 if (asf->stream_index < 0)
1167                     av_log(s, AV_LOG_ERROR, "ff asf skip %d (unknown stream)\n",
1168                            asf->packet_frag_size);
1169                 continue;
1170             }
1171             asf->asf_st = &asf->streams[s->streams[asf->stream_index]->id];
1172             if (!asf->packet_frag_offset)
1173                 asf->asf_st->skip_to_key = 0;
1174         }
1175         asf_st = asf->asf_st;
1176         av_assert0(asf_st);
1177 
1178         if (!asf_st->frag_offset && asf->packet_frag_offset) {
1179             av_log(s, AV_LOG_TRACE, "skipping asf data pkt with fragment offset for "
1180                     "stream:%d, expected:%d but got %d from pkt)\n",
1181                     asf->stream_index, asf_st->frag_offset,
1182                     asf->packet_frag_offset);
1183             avio_skip(pb, asf->packet_frag_size);
1184             asf->packet_size_left -= asf->packet_frag_size;
1185             continue;
1186         }
1187 
1188         if (asf->packet_replic_size == 1) {
1189             // frag_offset is here used as the beginning timestamp
1190             asf->packet_frag_timestamp = asf->packet_time_start;
1191             asf->packet_time_start    += asf->packet_time_delta;
1192             asf_st->packet_obj_size    = asf->packet_frag_size = avio_r8(pb);
1193             asf->packet_size_left--;
1194             asf->packet_multi_size--;
1195             if (asf->packet_multi_size < asf_st->packet_obj_size) {
1196                 asf->packet_time_start = 0;
1197                 avio_skip(pb, asf->packet_multi_size);
1198                 asf->packet_size_left -= asf->packet_multi_size;
1199                 continue;
1200             }
1201             asf->packet_multi_size -= asf_st->packet_obj_size;
1202         }
1203 
1204         if (asf_st->pkt.size != asf_st->packet_obj_size ||
1205             // FIXME is this condition sufficient?
1206             asf_st->frag_offset + asf->packet_frag_size > asf_st->pkt.size) {
1207             int ret;
1208 
1209             if (asf_st->pkt.data) {
1210                 av_log(s, AV_LOG_INFO,
1211                        "freeing incomplete packet size %d, new %d\n",
1212                        asf_st->pkt.size, asf_st->packet_obj_size);
1213                 asf_st->frag_offset = 0;
1214                 av_packet_unref(&asf_st->pkt);
1215             }
1216             /* new packet */
1217             if ((ret = av_new_packet(&asf_st->pkt, asf_st->packet_obj_size)) < 0)
1218                 return ret;
1219             asf_st->seq              = asf->packet_seq;
1220             if (asf->packet_frag_timestamp != AV_NOPTS_VALUE) {
1221                 if (asf->ts_is_pts) {
1222                     asf_st->pkt.pts          = asf->packet_frag_timestamp - asf->hdr.preroll;
1223                 } else
1224                     asf_st->pkt.dts          = asf->packet_frag_timestamp - asf->hdr.preroll;
1225             }
1226             asf_st->pkt.stream_index = asf->stream_index;
1227             asf_st->pkt.pos          = asf_st->packet_pos = asf->packet_pos;
1228             asf_st->pkt_clean        = 0;
1229 
1230             if (asf_st->pkt.data && asf_st->palette_changed) {
1231                 uint8_t *pal;
1232                 pal = av_packet_new_side_data(&asf_st->pkt, AV_PKT_DATA_PALETTE,
1233                                               AVPALETTE_SIZE);
1234                 if (!pal) {
1235                     av_log(s, AV_LOG_ERROR, "Cannot append palette to packet\n");
1236                 } else {
1237                     memcpy(pal, asf_st->palette, AVPALETTE_SIZE);
1238                     asf_st->palette_changed = 0;
1239                 }
1240             }
1241             av_log(asf, AV_LOG_TRACE, "new packet: stream:%d key:%d packet_key:%d audio:%d size:%d\n",
1242                     asf->stream_index, asf->packet_key_frame,
1243                     asf_st->pkt.flags & AV_PKT_FLAG_KEY,
1244                     s->streams[asf->stream_index]->codecpar->codec_type == AVMEDIA_TYPE_AUDIO,
1245                     asf_st->packet_obj_size);
1246             if (s->streams[asf->stream_index]->codecpar->codec_type == AVMEDIA_TYPE_AUDIO)
1247                 asf->packet_key_frame = 1;
1248             if (asf->packet_key_frame)
1249                 asf_st->pkt.flags |= AV_PKT_FLAG_KEY;
1250         }
1251 
1252         /* read data */
1253         av_log(asf, AV_LOG_TRACE, "READ PACKET s:%d  os:%d  o:%d,%d  l:%d   DATA:%p\n",
1254                 s->packet_size, asf_st->pkt.size, asf->packet_frag_offset,
1255                 asf_st->frag_offset, asf->packet_frag_size, asf_st->pkt.data);
1256         asf->packet_size_left -= asf->packet_frag_size;
1257         if (asf->packet_size_left < 0)
1258             continue;
1259 
1260         if (asf->packet_frag_offset >= asf_st->pkt.size ||
1261             asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset) {
1262             av_log(s, AV_LOG_ERROR,
1263                    "packet fragment position invalid %u,%u not in %u\n",
1264                    asf->packet_frag_offset, asf->packet_frag_size,
1265                    asf_st->pkt.size);
1266             continue;
1267         }
1268 
1269         if (asf->packet_frag_offset != asf_st->frag_offset && !asf_st->pkt_clean) {
1270             memset(asf_st->pkt.data + asf_st->frag_offset, 0, asf_st->pkt.size - asf_st->frag_offset);
1271             asf_st->pkt_clean = 1;
1272         }
1273 
1274         ret = avio_read(pb, asf_st->pkt.data + asf->packet_frag_offset,
1275                         asf->packet_frag_size);
1276         if (ret != asf->packet_frag_size) {
1277             if (ret < 0 || asf->packet_frag_offset + ret == 0)
1278                 return ret < 0 ? ret : AVERROR_EOF;
1279 
1280             if (asf_st->ds_span > 1) {
1281                 // scrambling, we can either drop it completely or fill the remainder
1282                 // TODO: should we fill the whole packet instead of just the current
1283                 // fragment?
1284                 memset(asf_st->pkt.data + asf->packet_frag_offset + ret, 0,
1285                        asf->packet_frag_size - ret);
1286                 ret = asf->packet_frag_size;
1287             } else {
1288                 // no scrambling, so we can return partial packets
1289                 av_shrink_packet(&asf_st->pkt, asf->packet_frag_offset + ret);
1290             }
1291         }
1292         if (s->key && s->keylen == 20)
1293             ff_asfcrypt_dec(s->key, asf_st->pkt.data + asf->packet_frag_offset,
1294                             ret);
1295         asf_st->frag_offset += ret;
1296         /* test if whole packet is read */
1297         if (asf_st->frag_offset == asf_st->pkt.size) {
1298             // workaround for macroshit radio DVR-MS files
1299             if (s->streams[asf->stream_index]->codecpar->codec_id == AV_CODEC_ID_MPEG2VIDEO &&
1300                 asf_st->pkt.size > 100) {
1301                 int i;
1302                 for (i = 0; i < asf_st->pkt.size && !asf_st->pkt.data[i]; i++)
1303                     ;
1304                 if (i == asf_st->pkt.size) {
1305                     av_log(s, AV_LOG_DEBUG, "discarding ms fart\n");
1306                     asf_st->frag_offset = 0;
1307                     av_packet_unref(&asf_st->pkt);
1308                     continue;
1309                 }
1310             }
1311 
1312             /* return packet */
1313             if (asf_st->ds_span > 1) {
1314                 if (asf_st->pkt.size != asf_st->ds_packet_size * asf_st->ds_span) {
1315                     av_log(s, AV_LOG_ERROR,
1316                            "pkt.size != ds_packet_size * ds_span (%d %d %d)\n",
1317                            asf_st->pkt.size, asf_st->ds_packet_size,
1318                            asf_st->ds_span);
1319                 } else {
1320                     /* packet descrambling */
1321                     AVBufferRef *buf = av_buffer_alloc(asf_st->pkt.size +
1322                                                        AV_INPUT_BUFFER_PADDING_SIZE);
1323                     if (buf) {
1324                         uint8_t *newdata = buf->data;
1325                         int offset = 0;
1326                         memset(newdata + asf_st->pkt.size, 0,
1327                                AV_INPUT_BUFFER_PADDING_SIZE);
1328                         while (offset < asf_st->pkt.size) {
1329                             int off = offset / asf_st->ds_chunk_size;
1330                             int row = off / asf_st->ds_span;
1331                             int col = off % asf_st->ds_span;
1332                             int idx = row + col * asf_st->ds_packet_size / asf_st->ds_chunk_size;
1333                             assert(offset + asf_st->ds_chunk_size <= asf_st->pkt.size);
1334                             assert(idx + 1 <= asf_st->pkt.size / asf_st->ds_chunk_size);
1335                             memcpy(newdata + offset,
1336                                    asf_st->pkt.data + idx * asf_st->ds_chunk_size,
1337                                    asf_st->ds_chunk_size);
1338                             offset += asf_st->ds_chunk_size;
1339                         }
1340                         av_buffer_unref(&asf_st->pkt.buf);
1341                         asf_st->pkt.buf  = buf;
1342                         asf_st->pkt.data = buf->data;
1343                     }
1344                 }
1345             }
1346             asf_st->frag_offset         = 0;
1347             *pkt                        = asf_st->pkt;
1348             asf_st->pkt.buf             = 0;
1349             asf_st->pkt.size            = 0;
1350             asf_st->pkt.data            = 0;
1351             asf_st->pkt.side_data_elems = 0;
1352             asf_st->pkt.side_data       = NULL;
1353             break; // packet completed
1354         }
1355     }
1356     return 0;
1357 }
1358 
asf_read_packet(AVFormatContext *s, AVPacket *pkt)1359 static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
1360 {
1361     ASFContext *asf = s->priv_data;
1362 
1363     for (;;) {
1364         int ret;
1365 
1366         /* parse cached packets, if any */
1367         if ((ret = asf_parse_packet(s, s->pb, pkt)) <= 0)
1368             return ret;
1369         if ((ret = asf_get_packet(s, s->pb)) < 0)
1370             assert(asf->packet_size_left < FRAME_HEADER_SIZE ||
1371                    asf->packet_segments < 1);
1372         asf->packet_time_start = 0;
1373     }
1374 }
1375 
1376 // Added to support seeking after packets have been read
1377 // If information is not reset, read_packet fails due to
1378 // leftover information from previous reads
asf_reset_header(AVFormatContext *s)1379 static void asf_reset_header(AVFormatContext *s)
1380 {
1381     ASFContext *asf = s->priv_data;
1382     ASFStream *asf_st;
1383     int i;
1384 
1385     asf->packet_size_left      = 0;
1386     asf->packet_flags          = 0;
1387     asf->packet_property       = 0;
1388     asf->packet_timestamp      = 0;
1389     asf->packet_segsizetype    = 0;
1390     asf->packet_segments       = 0;
1391     asf->packet_seq            = 0;
1392     asf->packet_replic_size    = 0;
1393     asf->packet_key_frame      = 0;
1394     asf->packet_padsize        = 0;
1395     asf->packet_frag_offset    = 0;
1396     asf->packet_frag_size      = 0;
1397     asf->packet_frag_timestamp = 0;
1398     asf->packet_multi_size     = 0;
1399     asf->packet_time_delta     = 0;
1400     asf->packet_time_start     = 0;
1401 
1402     for (i = 0; i < 128; i++) {
1403         asf_st = &asf->streams[i];
1404         av_packet_unref(&asf_st->pkt);
1405         asf_st->packet_obj_size = 0;
1406         asf_st->frag_offset = 0;
1407         asf_st->seq         = 0;
1408     }
1409     asf->asf_st = NULL;
1410 }
1411 
skip_to_key(AVFormatContext *s)1412 static void skip_to_key(AVFormatContext *s)
1413 {
1414     ASFContext *asf = s->priv_data;
1415     int i;
1416 
1417     for (i = 0; i < 128; i++) {
1418         int j = asf->asfid2avid[i];
1419         ASFStream *asf_st = &asf->streams[i];
1420         if (j < 0 || s->streams[j]->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
1421             continue;
1422 
1423         asf_st->skip_to_key = 1;
1424     }
1425 }
1426 
asf_read_close(AVFormatContext *s)1427 static int asf_read_close(AVFormatContext *s)
1428 {
1429     asf_reset_header(s);
1430 
1431     return 0;
1432 }
1433 
asf_read_pts(AVFormatContext *s, int stream_index, int64_t *ppos, int64_t pos_limit)1434 static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
1435                             int64_t *ppos, int64_t pos_limit)
1436 {
1437     FFFormatContext *const si = ffformatcontext(s);
1438     ASFContext *asf     = s->priv_data;
1439     AVPacket pkt1, *pkt = &pkt1;
1440     ASFStream *asf_st;
1441     int64_t pts;
1442     int64_t pos = *ppos;
1443     int i;
1444     int64_t start_pos[ASF_MAX_STREAMS];
1445 
1446     for (i = 0; i < s->nb_streams; i++)
1447         start_pos[i] = pos;
1448 
1449     if (s->packet_size > 0)
1450         pos = (pos + s->packet_size - 1 - si->data_offset) /
1451               s->packet_size * s->packet_size +
1452               si->data_offset;
1453     *ppos = pos;
1454     if (avio_seek(s->pb, pos, SEEK_SET) < 0)
1455         return AV_NOPTS_VALUE;
1456 
1457     ff_read_frame_flush(s);
1458     asf_reset_header(s);
1459     for (;;) {
1460         if (av_read_frame(s, pkt) < 0) {
1461             av_log(s, AV_LOG_INFO, "asf_read_pts failed\n");
1462             return AV_NOPTS_VALUE;
1463         }
1464 
1465         pts = pkt->dts;
1466 
1467         if (pkt->flags & AV_PKT_FLAG_KEY) {
1468             i = pkt->stream_index;
1469 
1470             asf_st = &asf->streams[s->streams[i]->id];
1471 
1472 //            assert((asf_st->packet_pos - s->data_offset) % s->packet_size == 0);
1473             pos = asf_st->packet_pos;
1474             av_assert1(pkt->pos == asf_st->packet_pos);
1475 
1476             av_add_index_entry(s->streams[i], pos, pts, pkt->size,
1477                                pos - start_pos[i] + 1, AVINDEX_KEYFRAME);
1478             start_pos[i] = asf_st->packet_pos + 1;
1479 
1480             if (pkt->stream_index == stream_index) {
1481                 av_packet_unref(pkt);
1482                 break;
1483             }
1484         }
1485         av_packet_unref(pkt);
1486     }
1487 
1488     *ppos = pos;
1489     return pts;
1490 }
1491 
asf_build_simple_index(AVFormatContext *s, int stream_index)1492 static int asf_build_simple_index(AVFormatContext *s, int stream_index)
1493 {
1494     ff_asf_guid g;
1495     ASFContext *asf     = s->priv_data;
1496     int64_t current_pos = avio_tell(s->pb);
1497     int64_t ret;
1498 
1499     if((ret = avio_seek(s->pb, asf->data_object_offset + asf->data_object_size, SEEK_SET)) < 0) {
1500         return ret;
1501     }
1502 
1503     if ((ret = ff_get_guid(s->pb, &g)) < 0)
1504         goto end;
1505 
1506     /* the data object can be followed by other top-level objects,
1507      * skip them until the simple index object is reached */
1508     while (ff_guidcmp(&g, &ff_asf_simple_index_header)) {
1509         int64_t gsize = avio_rl64(s->pb);
1510         if (gsize < 24 || avio_feof(s->pb)) {
1511             goto end;
1512         }
1513         avio_skip(s->pb, gsize - 24);
1514         if ((ret = ff_get_guid(s->pb, &g)) < 0)
1515             goto end;
1516     }
1517 
1518     {
1519         int64_t itime, last_pos = -1;
1520         int pct, ict;
1521         int i;
1522         int64_t av_unused gsize = avio_rl64(s->pb);
1523         if ((ret = ff_get_guid(s->pb, &g)) < 0)
1524             goto end;
1525         itime = avio_rl64(s->pb);
1526         pct   = avio_rl32(s->pb);
1527         ict   = avio_rl32(s->pb);
1528         av_log(s, AV_LOG_DEBUG,
1529                "itime:0x%"PRIx64", pct:%d, ict:%d\n", itime, pct, ict);
1530 
1531         for (i = 0; i < ict; i++) {
1532             int pktnum        = avio_rl32(s->pb);
1533             int pktct         = avio_rl16(s->pb);
1534             int64_t pos       = ffformatcontext(s)->data_offset + s->packet_size * (int64_t)pktnum;
1535             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);
1536 
1537             if (avio_feof(s->pb)) {
1538                 ret = AVERROR_INVALIDDATA;
1539                 goto end;
1540             }
1541 
1542             if (pos != last_pos) {
1543                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",
1544                        pktnum, pktct, index_pts);
1545                 av_add_index_entry(s->streams[stream_index], pos, index_pts,
1546                                    s->packet_size, 0, AVINDEX_KEYFRAME);
1547                 last_pos = pos;
1548             }
1549         }
1550         asf->index_read = ict > 1;
1551     }
1552 end:
1553 //     if (avio_feof(s->pb)) {
1554 //         ret = 0;
1555 //     }
1556     avio_seek(s->pb, current_pos, SEEK_SET);
1557     return ret;
1558 }
1559 
asf_read_seek(AVFormatContext *s, int stream_index, int64_t pts, int flags)1560 static int asf_read_seek(AVFormatContext *s, int stream_index,
1561                          int64_t pts, int flags)
1562 {
1563     ASFContext *asf = s->priv_data;
1564     AVStream *st    = s->streams[stream_index];
1565     FFStream *const sti = ffstream(st);
1566     int ret = 0;
1567 
1568     if (s->packet_size <= 0)
1569         return -1;
1570 
1571     /* Try using the protocol's read_seek if available */
1572     if (s->pb) {
1573         int64_t ret = avio_seek_time(s->pb, stream_index, pts, flags);
1574         if (ret >= 0)
1575             asf_reset_header(s);
1576         if (ret != AVERROR(ENOSYS))
1577             return ret;
1578     }
1579 
1580     /* explicitly handle the case of seeking to 0 */
1581     if (!pts) {
1582         asf_reset_header(s);
1583         avio_seek(s->pb, ffformatcontext(s)->data_offset, SEEK_SET);
1584         return 0;
1585     }
1586 
1587     if (!asf->index_read) {
1588         ret = asf_build_simple_index(s, stream_index);
1589         if (ret < 0)
1590             asf->index_read = -1;
1591     }
1592 
1593     if (asf->index_read > 0 && sti->index_entries) {
1594         int index = av_index_search_timestamp(st, pts, flags);
1595         if (index >= 0) {
1596             /* find the position */
1597             uint64_t pos = sti->index_entries[index].pos;
1598 
1599             /* do the seek */
1600             av_log(s, AV_LOG_DEBUG, "SEEKTO: %"PRId64"\n", pos);
1601             if(avio_seek(s->pb, pos, SEEK_SET) < 0)
1602                 return -1;
1603             asf_reset_header(s);
1604             skip_to_key(s);
1605             return 0;
1606         }
1607     }
1608     /* no index or seeking by index failed */
1609     if (ff_seek_frame_binary(s, stream_index, pts, flags) < 0)
1610         return -1;
1611     asf_reset_header(s);
1612     skip_to_key(s);
1613     return 0;
1614 }
1615 
1616 const AVInputFormat ff_asf_demuxer = {
1617     .name           = "asf",
1618     .long_name      = NULL_IF_CONFIG_SMALL("ASF (Advanced / Active Streaming Format)"),
1619     .priv_data_size = sizeof(ASFContext),
1620     .read_probe     = asf_probe,
1621     .read_header    = asf_read_header,
1622     .read_packet    = asf_read_packet,
1623     .read_close     = asf_read_close,
1624     .read_seek      = asf_read_seek,
1625     .read_timestamp = asf_read_pts,
1626     .flags          = AVFMT_NOBINSEARCH | AVFMT_NOGENSEARCH,
1627     .priv_class     = &asf_class,
1628 };
1629