[FFmpeg-devel] [PATCH 4/5] avformat/mpegts: parse and export descriptor 6a side data

[Andreas Rheinhardt]

lance.lmwang at gmail.com:
> From: Limin Wang <lance.lmwang at gmail.com>
> 
> Signed-off-by: Limin Wang <lance.lmwang at gmail.com>
> ---
>  libavformat/mpegts.c    | 49 +++++++++++++++++++++++++++++++++++++++++++++----
>  tests/ref/fate/ts-demux |  2 +-
>  2 files changed, 46 insertions(+), 5 deletions(-)
> 
> diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
> index c6fd3e1..b5ea5a1 100644
> --- a/libavformat/mpegts.c
> +++ b/libavformat/mpegts.c
> @@ -29,6 +29,7 @@
>  #include "libavutil/opt.h"
>  #include "libavutil/avassert.h"
>  #include "libavutil/dovi_meta.h"
> +#include "libavutil/mpegts_audio_desc_metadata.h"
>  #include "libavcodec/bytestream.h"
>  #include "libavcodec/get_bits.h"
>  #include "libavcodec/opus.h"
> @@ -2073,16 +2074,56 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type
>          break;
>      case 0x6a: /* ac-3_descriptor */
>          {
> -            int component_type_flag = get8(pp, desc_end) & (1 << 7);
> -            if (component_type_flag) {
> -                int component_type = get8(pp, desc_end);
> +            int     ret;
> +            uint8_t buf;
> +            size_t  desc6a_size;
> +            AVDescriptor6A *desc6a;
> +
> +            if (desc_end - *pp < 1)
> +                return AVERROR_INVALIDDATA;
> +
> +            desc6a = av_desc6a_alloc(&desc6a_size);
> +            if (!desc6a)
> +                return AVERROR(ENOMEM);
> +            buf = get8(pp, desc_end);
> +            desc6a->component_type_flag = (buf >> 7) & 0x1;
> +            desc6a->bsid_flag           = (buf >> 6) & 0x1;
> +            desc6a->mainid_flag         = (buf >> 5) & 0x1;
> +            desc6a->asvc_flag           = (buf >> 4) & 0x1;
> +            if (desc6a->component_type_flag) {
>                  int service_type_mask = 0x38;  // 0b00111000
> -                int service_type = ((component_type & service_type_mask) >> 3);
> +                int service_type;
> +
> +                if (desc_end - *pp < 1)
> +                    return AVERROR_INVALIDDATA;
> +                desc6a->component_type = get8(pp, desc_end);
> +                service_type = ((desc6a->component_type & service_type_mask) >> 3);
>                  if (service_type == 0x02 /* 0b010 */) {
>                      st->disposition |= AV_DISPOSITION_DESCRIPTIONS;
>                      av_log(ts ? ts->stream : fc, AV_LOG_DEBUG, "New track disposition for id %u: %u\n", st->id, st->disposition);
>                  }
>              }
> +            if (desc6a->bsid_flag) {
> +                if (desc_end - *pp < 1)
> +                    return AVERROR_INVALIDDATA;
> +                desc6a->bsid = get8(pp, desc_end);
> +            }
> +            if (desc6a->mainid_flag) {
> +                if (desc_end - *pp < 1)
> +                    return AVERROR_INVALIDDATA;
> +                desc6a->mainid = get8(pp, desc_end);
> +            }
> +            if (desc6a->asvc_flag) {
> +                if (desc_end - *pp < 1)
> +                    return AVERROR_INVALIDDATA;

desc6a leaks in each of these error paths.

> +                desc6a->asvc_flag = get8(pp, desc_end);
> +            }
> +            ret = av_stream_add_side_data(st, AV_PKT_DATA_MPEGTS_DESC_6A,
> +                                         (uint8_t *)desc6a, desc6a_size);
> +            if (ret < 0) {
> +                av_free(desc6a);
> +                return ret;
> +            }
>          }
>          break;
>      case 0x7a: /* enhanced_ac-3_descriptor */
> diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux
> index cdf34d6..dfe0374 100644
> --- a/tests/ref/fate/ts-demux
> +++ b/tests/ref/fate/ts-demux
> @@ -10,7 +10,7 @@
>  #sample_rate 1: 48000
>  #channel_layout 1: 60f
>  #channel_layout_name 1: 5.1(side)
> -1,          0,          0,     2880,     1536, 0x773ffeea, S=1,        1, 0x00bd00bd
> +1,          0,          0,     2880,     1536, 0x773ffeea, S=2,        1, 0x00bd00bd,        9, 0x00000000
>  1,       2880,       2880,     2880,     1536, 0x6dc10748
>  1,       5760,       5760,     2880,     1536, 0xbab5129c
>  1,       8640,       8640,     2880,     1536, 0x602f034b, S=1,        1, 0x00bd00bd
>