ffmpeg roll of source to mar 9 version...

patched-ffmpeg-mt/libavformat/mov.c

 /*
  * MOV demuxer
  * Copyright (c) 2001 Fabrice Bellard
  * Copyright (c) 2009 Baptiste Coudurier <baptiste dot coudurier at gmail dot com>
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
@@ skipping 75 matching lines @@
 
     get_be16(pb); // unknown
     snprintf(buf, sizeof(buf), "%d", get_be16(pb));
     av_metadata_set(&c->fc->metadata, "track", buf);
 
     get_be16(pb); // total tracks
 
     return 0;
 }
 
+static const uint32_t mac_to_unicode[128] = {
+    0x00C4,0x00C5,0x00C7,0x00C9,0x00D1,0x00D6,0x00DC,0x00E1,
+    0x00E0,0x00E2,0x00E4,0x00E3,0x00E5,0x00E7,0x00E9,0x00E8,
+    0x00EA,0x00EB,0x00ED,0x00EC,0x00EE,0x00EF,0x00F1,0x00F3,
+    0x00F2,0x00F4,0x00F6,0x00F5,0x00FA,0x00F9,0x00FB,0x00FC,
+    0x2020,0x00B0,0x00A2,0x00A3,0x00A7,0x2022,0x00B6,0x00DF,
+    0x00AE,0x00A9,0x2122,0x00B4,0x00A8,0x2260,0x00C6,0x00D8,
+    0x221E,0x00B1,0x2264,0x2265,0x00A5,0x00B5,0x2202,0x2211,
+    0x220F,0x03C0,0x222B,0x00AA,0x00BA,0x03A9,0x00E6,0x00F8,
+    0x00BF,0x00A1,0x00AC,0x221A,0x0192,0x2248,0x2206,0x00AB,
+    0x00BB,0x2026,0x00A0,0x00C0,0x00C3,0x00D5,0x0152,0x0153,
+    0x2013,0x2014,0x201C,0x201D,0x2018,0x2019,0x00F7,0x25CA,
+    0x00FF,0x0178,0x2044,0x20AC,0x2039,0x203A,0xFB01,0xFB02,
+    0x2021,0x00B7,0x201A,0x201E,0x2030,0x00C2,0x00CA,0x00C1,
+    0x00CB,0x00C8,0x00CD,0x00CE,0x00CF,0x00CC,0x00D3,0x00D4,
+    0xF8FF,0x00D2,0x00DA,0x00DB,0x00D9,0x0131,0x02C6,0x02DC,
+    0x00AF,0x02D8,0x02D9,0x02DA,0x00B8,0x02DD,0x02DB,0x02C7,
+};
+
+static int mov_read_mac_string(MOVContext *c, ByteIOContext *pb, int len,
+                               char *dst, int dstlen)
+{
+    char *p = dst;
+    char *end = dst+dstlen-1;
+    int i;
+
+    for (i = 0; i < len; i++) {
+        uint8_t t, c = get_byte(pb);
+        if (c < 0x80 && p < end)
+            *p++ = c;
+        else
+            PUT_UTF8(mac_to_unicode[c-0x80], t, if (p < end) *p++ = t;);
+    }
+    *p = 0;
+    return p - dst;
+}
+
 static int mov_read_udta_string(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
 {
 #ifdef MOV_EXPORT_ALL_METADATA
     char tmp_key[5];
 #endif
     char str[1024], key2[16], language[4] = {0};
     const char *key = NULL;
-    uint16_t str_size;
+    uint16_t str_size, langcode = 0;
+    uint32_t data_type = 0;
     int (*parse)(MOVContext*, ByteIOContext*, unsigned) = NULL;
 
     switch (atom.type) {
     case MKTAG(0xa9,'n','a','m'): key = "title";     break;
     case MKTAG(0xa9,'a','u','t'):
     case MKTAG(0xa9,'A','R','T'): key = "author";    break;
     case MKTAG(0xa9,'w','r','t'): key = "composer";  break;
     case MKTAG( 'c','p','r','t'):
     case MKTAG(0xa9,'c','p','y'): key = "copyright"; break;
     case MKTAG(0xa9,'c','m','t'):
     case MKTAG(0xa9,'i','n','f'): key = "comment";   break;
     case MKTAG(0xa9,'a','l','b'): key = "album";     break;
     case MKTAG(0xa9,'d','a','y'): key = "date";      break;
     case MKTAG(0xa9,'g','e','n'): key = "genre";     break;
     case MKTAG(0xa9,'t','o','o'):
     case MKTAG(0xa9,'e','n','c'): key = "encoder";   break;
     case MKTAG( 'd','e','s','c'): key = "description";break;
     case MKTAG( 'l','d','e','s'): key = "synopsis";  break;
     case MKTAG( 't','v','s','h'): key = "show";      break;
     case MKTAG( 't','v','e','n'): key = "episode_id";break;
     case MKTAG( 't','v','n','n'): key = "network";   break;
     case MKTAG( 't','r','k','n'): key = "track";
         parse = mov_metadata_trkn; break;
     }
 
     if (c->itunes_metadata && atom.size > 8) {
         int data_size = get_be32(pb);
         int tag = get_le32(pb);
         if (tag == MKTAG('d','a','t','a')) {
-            get_be32(pb); // type
+            data_type = get_be32(pb); // type
             get_be32(pb); // unknown
             str_size = data_size - 16;
             atom.size -= 16;
         } else return 0;
     } else if (atom.size > 4 && key && !c->itunes_metadata) {
         str_size = get_be16(pb); // string length
-        ff_mov_lang_to_iso639(get_be16(pb), language);
+        langcode = get_be16(pb);
+        ff_mov_lang_to_iso639(langcode, language);
         atom.size -= 4;
     } else
         str_size = atom.size;
 
 #ifdef MOV_EXPORT_ALL_METADATA
     if (!key) {
         snprintf(tmp_key, 5, "%.4s", (char*)&atom.type);
         key = tmp_key;
     }
 #endif
 
     if (!key)
         return 0;
     if (atom.size < 0)
         return -1;
 
     str_size = FFMIN3(sizeof(str)-1, str_size, atom.size);
 
     if (parse)
         parse(c, pb, str_size);
     else {
-        get_buffer(pb, str, str_size);
-        str[str_size] = 0;
+        if (data_type == 3 || (data_type == 0 && langcode < 0x800)) { // MAC Encoded
+            mov_read_mac_string(c, pb, str_size, str, sizeof(str));
+        } else {
+            get_buffer(pb, str, str_size);
+            str[str_size] = 0;
+        }
         av_metadata_set(&c->fc->metadata, key, str);
         if (*language && strcmp(language, "und")) {
             snprintf(key2, sizeof(key2), "%s-%s", key, language);
             av_metadata_set(&c->fc->metadata, key2, str);
         }
     }
 #ifdef DEBUG_METADATA
     av_log(c->fc, AV_LOG_DEBUG, "lang \"%3s\" ", language);
     av_log(c->fc, AV_LOG_DEBUG, "tag \"%s\" value \"%s\" atom \"%.4s\" %d %lld\n",
            key, str, (char*)&atom.type, str_size, atom.size);
@@ skipping 217 matching lines @@
     int count = 4;
     while (count--) {
         int c = get_byte(pb);
         len = (len << 7) | (c & 0x7f);
         if (!(c & 0x80))
             break;
     }
     return len;
 }
 
-int mp4_read_descr(AVFormatContext *fc, ByteIOContext *pb, int *tag)
+static int mp4_read_descr(AVFormatContext *fc, ByteIOContext *pb, int *tag)
 {
     int len;
     *tag = get_byte(pb);
     len = ff_mp4_read_descr_len(pb);
     dprintf(fc, "MPEG4 description: tag=0x%02x len=%d\n", *tag, len);
     return len;
 }
 
 #define MP4ESDescrTag                   0x03
 #define MP4DecConfigDescrTag            0x04
@@ skipping 494 matching lines @@
                 if(id > 0)
                     st->codec->codec_type = CODEC_TYPE_SUBTITLE;
             }
         }
 
         dprintf(c->fc, "size=%d 4CC= %c%c%c%c codec_type=%d\n", size,
                 (format >> 0) & 0xff, (format >> 8) & 0xff, (format >> 16) & 0xff,
                 (format >> 24) & 0xff, st->codec->codec_type);
 
         if(st->codec->codec_type==CODEC_TYPE_VIDEO) {
-            uint8_t codec_name[32];
-            unsigned int color_depth;
+            unsigned int color_depth, len;
             int color_greyscale;
 
             st->codec->codec_id = id;
             get_be16(pb); /* version */
             get_be16(pb); /* revision level */
             get_be32(pb); /* vendor */
             get_be32(pb); /* temporal quality */
             get_be32(pb); /* spatial quality */
 
             st->codec->width = get_be16(pb); /* width */
             st->codec->height = get_be16(pb); /* height */
 
             get_be32(pb); /* horiz resolution */
             get_be32(pb); /* vert resolution */
             get_be32(pb); /* data size, always 0 */
             get_be16(pb); /* frames per samples */
 
-            get_buffer(pb, codec_name, 32); /* codec name, pascal string */
-            if (codec_name[0] <= 31) {
-                int i;
-                int pos = 0;
-                for (i = 0; i < codec_name[0] && pos < sizeof(st->codec->codec_name) - 3; i++) {
-                    uint8_t tmp;
-                    PUT_UTF8(codec_name[i+1], tmp, st->codec->codec_name[pos++] = tmp;)
-                }
-                st->codec->codec_name[pos] = 0;
-                /* codec_tag YV12 triggers an UV swap in rawdec.c */
-                if (!memcmp(st->codec->codec_name, "Planar Y'CbCr 8-bit 4:2:0", 25))
-                    st->codec->codec_tag=MKTAG('I', '4', '2', '0');
-            }
+            len = get_byte(pb); /* codec name, pascal string */
+            if (len > 31)
+                len = 31;
+            mov_read_mac_string(c, pb, len, st->codec->codec_name, 32);
+            if (len < 31)
+                url_fskip(pb, 31 - len);
+            /* codec_tag YV12 triggers an UV swap in rawdec.c */
+            if (!memcmp(st->codec->codec_name, "Planar Y'CbCr 8-bit 4:2:0", 25))
+                st->codec->codec_tag=MKTAG('I', '4', '2', '0');
 
             st->codec->bits_per_coded_sample = get_be16(pb); /* depth */
             st->codec->color_table_id = get_be16(pb); /* colortable id */
             dprintf(c->fc, "depth %d, ctab id %d\n",
                    st->codec->bits_per_coded_sample, st->codec->color_table_id);
             /* figure out the palette situation */
             color_depth = st->codec->bits_per_coded_sample & 0x1F;
             color_greyscale = st->codec->bits_per_coded_sample & 0x20;
 
             /* if the depth is 2, 4, or 8 bpp, file is palettized */
@@ skipping 499 matching lines @@
     if (!(st->codec->codec_type == CODEC_TYPE_AUDIO &&
           sc->stts_count == 1 && sc->stts_data[0].duration == 1)) {
         unsigned int current_sample = 0;
         unsigned int stts_sample = 0;
         unsigned int sample_size;
         unsigned int distance = 0;
         int key_off = sc->keyframes && sc->keyframes[0] == 1;
 
         current_dts -= sc->dts_shift;
 
+        if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries))
+            return;
+        st->index_entries = av_malloc(sc->sample_count*sizeof(*st->index_entries));
+        if (!st->index_entries)
+            return;
+        st->index_entries_allocated_size = sc->sample_count*sizeof(*st->index_entries);
+
         for (i = 0; i < sc->chunk_count; i++) {
             current_offset = sc->chunk_offsets[i];
             if (stsc_index + 1 < sc->stsc_count &&
                 i + 1 == sc->stsc_data[stsc_index + 1].first)
                 stsc_index++;
             for (j = 0; j < sc->stsc_data[stsc_index].count; j++) {
                 int keyframe = 0;
                 if (current_sample >= sc->sample_count) {
                     av_log(mov->fc, AV_LOG_ERROR, "wrong sample count\n");
                     return;
                 }
 
                 if (!sc->keyframe_count || current_sample+key_off == sc->keyframes[stss_index]) {
                     keyframe = 1;
                     if (stss_index + 1 < sc->keyframe_count)
                         stss_index++;
                 } else if (sc->stps_count && current_sample+key_off == sc->stps_data[stps_index]) {
                     keyframe = 1;
                     if (stps_index + 1 < sc->stps_count)
                         stps_index++;
                 }
                 if (keyframe)
                     distance = 0;
                 sample_size = sc->sample_size > 0 ? sc->sample_size : sc->sample_sizes[current_sample];
                 if(sc->pseudo_stream_id == -1 ||
                    sc->stsc_data[stsc_index].id - 1 == sc->pseudo_stream_id) {
-                    av_add_index_entry(st, current_offset, current_dts, sample_size, distance,
-                                    keyframe ? AVINDEX_KEYFRAME : 0);
+                    AVIndexEntry *e = &st->index_entries[st->nb_index_entries++];
+                    e->pos = current_offset;
+                    e->timestamp = current_dts;
+                    e->size = sample_size;
+                    e->min_distance = distance;
+                    e->flags = keyframe ? AVINDEX_KEYFRAME : 0;
                     dprintf(mov->fc, "AVIndex stream %d, sample %d, offset %"PRIx64", dts %"PRId64", "
                             "size %d, distance %d, keyframe %d\n", st->index, current_sample,
                             current_offset, current_dts, sample_size, distance, keyframe);
                 }
 
                 current_offset += sample_size;
                 stream_size += sample_size;
                 current_dts += sc->stts_data[stts_index].duration;
                 distance++;
                 stts_sample++;
                 current_sample++;
                 if (stts_index + 1 < sc->stts_count && stts_sample == sc->stts_data[stts_index].count) {
                     stts_sample = 0;
                     stts_index++;
                 }
             }
         }
         if (st->duration > 0)
             st->codec->bit_rate = stream_size*8*sc->time_scale/st->duration;
     } else {
+        unsigned chunk_samples, total = 0;
+
+        // compute total chunk count
+        for (i = 0; i < sc->stsc_count; i++) {
+            unsigned count, chunk_count;
+
+            chunk_samples = sc->stsc_data[i].count;
+            if (sc->samples_per_frame && chunk_samples % sc->samples_per_frame) {
+                av_log(mov->fc, AV_LOG_ERROR, "error unaligned chunk\n");
+                return;
+            }
+
+            if (sc->samples_per_frame >= 160) { // gsm
+                count = chunk_samples / sc->samples_per_frame;
+            } else if (sc->samples_per_frame > 1) {
+                unsigned samples = (1024/sc->samples_per_frame)*sc->samples_per_frame;
+                count = (chunk_samples+samples-1) / samples;
+            } else {
+                count = (chunk_samples+1023) / 1024;
+            }
+
+            if (i < sc->stsc_count - 1)
+                chunk_count = sc->stsc_data[i+1].first - sc->stsc_data[i].first;
+            else
+                chunk_count = sc->chunk_count - (sc->stsc_data[i].first - 1);
+            total += chunk_count * count;
+        }
+
+        dprintf(mov->fc, "chunk count %d\n", total);
+        if (total >= UINT_MAX / sizeof(*st->index_entries))
+            return;
+        st->index_entries = av_malloc(total*sizeof(*st->index_entries));
+        if (!st->index_entries)
+            return;
+        st->index_entries_allocated_size = total*sizeof(*st->index_entries);
+
+        // populate index
         for (i = 0; i < sc->chunk_count; i++) {
-            unsigned chunk_samples;
-
             current_offset = sc->chunk_offsets[i];
             if (stsc_index + 1 < sc->stsc_count &&
                 i + 1 == sc->stsc_data[stsc_index + 1].first)
                 stsc_index++;
             chunk_samples = sc->stsc_data[stsc_index].count;
 
-            if (sc->samples_per_frame && chunk_samples % sc->samples_per_frame) {
-                av_log(mov->fc, AV_LOG_ERROR, "error unaligned chunk\n");
-                return;
-            }
-
             while (chunk_samples > 0) {
+                AVIndexEntry *e;
                 unsigned size, samples;
 
                 if (sc->samples_per_frame >= 160) { // gsm
                     samples = sc->samples_per_frame;
                     size = sc->bytes_per_frame;
                 } else {
                     if (sc->samples_per_frame > 1) {
                         samples = FFMIN((1024 / sc->samples_per_frame)*
                                         sc->samples_per_frame, chunk_samples);
                         size = (samples / sc->samples_per_frame) * sc->bytes_per_frame;
                     } else {
                         samples = FFMIN(1024, chunk_samples);
                         size = samples * sc->sample_size;
                     }
                 }
 
-                av_add_index_entry(st, current_offset, current_dts, size, 0, AVINDEX_KEYFRAME);
+                if (st->nb_index_entries >= total) {
+                    av_log(mov->fc, AV_LOG_ERROR, "wrong chunk count %d\n", total);
+                    return;
+                }
+                e = &st->index_entries[st->nb_index_entries++];
+                e->pos = current_offset;
+                e->timestamp = current_dts;
+                e->size = size;
+                e->min_distance = 0;
+                e->flags = AVINDEX_KEYFRAME;
                 dprintf(mov->fc, "AVIndex stream %d, chunk %d, offset %"PRIx64", dts %"PRId64", "
                         "size %d, duration %d\n", st->index, i, current_offset, current_dts,
                         size, samples);
 
                 current_offset += size;
                 current_dts += samples;
                 chunk_samples -= samples;
             }
         }
     }
 }
 
 static int mov_open_dref(ByteIOContext **pb, char *src, MOVDref *ref)
 {
-    /* try absolute path */
-    if (!url_fopen(pb, ref->path, URL_RDONLY))
-        return 0;
-
-    /* try relative path */
+    /* try relative path, we do not try the absolute because it can leak information about our
+       system to an attacker */
     if (ref->nlvl_to > 0 && ref->nlvl_from > 0) {
         char filename[1024];
         char *src_path;
         int i, l;
 
         /* find a source dir */
         src_path = strrchr(src, '/');
         if (src_path)
             src_path++;
         else
             src_path = src;
 
         /* find a next level down to target */
         for (i = 0, l = strlen(ref->path) - 1; l >= 0; l--)
             if (ref->path[l] == '/') {
                 if (i == ref->nlvl_to - 1)
                     break;
                 else
                     i++;
             }
 
         /* compose filename if next level down to target was found */
-        if (i == ref->nlvl_to - 1) {
+        if (i == ref->nlvl_to - 1 && src_path - src  < sizeof(filename)) {
             memcpy(filename, src, src_path - src);
             filename[src_path - src] = 0;
 
             for (i = 1; i < ref->nlvl_from; i++)
                 av_strlcat(filename, "../", 1024);
 
             av_strlcat(filename, ref->path + l + 1, 1024);
 
             if (!url_fopen(pb, filename, URL_RDONLY))
                 return 0;
@@ skipping 765 matching lines @@
 AVInputFormat mov_demuxer = {
     "mov,mp4,m4a,3gp,3g2,mj2",
     NULL_IF_CONFIG_SMALL("QuickTime/MPEG-4/Motion JPEG 2000 format"),
     sizeof(MOVContext),
     mov_probe,
     mov_read_header,
     mov_read_packet,
     mov_read_close,
     mov_read_seek,
 };