[FFmpeg-devel] [PATCH v2] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[Sebastian Dröge]

From: Sebastian Dröge <sebastian at centricular.com>

The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes.
cdat contains EIA608 byte pairs for field 1, cdt2 for field 2.

Previously any box following the first was treated as EIA608 byte pairs
instead of parsing them correctly, and all data was handled as field 1.
---

Changes compared to v1:
  - Skip over unknown boxes instead of erroring out, as required by the spec.
  - Calculate write_size correctly.

 libavformat/mov.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9fdeef057e..341b42228d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8868,22 +8868,43 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
 
 static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
 {
-    int new_size, ret;
+    const uint32_t cdat_fourcc = AV_RL32("cdat");
+    const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+    int new_size, write_size, ret;
 
     if (size <= 8)
         return AVERROR_INVALIDDATA;
+
     new_size = ((size - 8) / 2) * 3;
     ret = av_new_packet(pkt, new_size);
     if (ret < 0)
         return ret;
 
-    avio_skip(pb, 8);
-    for (int j = 0; j < new_size; j += 3) {
-        pkt->data[j] = 0xFC;
-        pkt->data[j+1] = avio_r8(pb);
-        pkt->data[j+2] = avio_r8(pb);
+    write_size = 0;
+    while (size > 8) {
+      uint32_t box_size = avio_rb32(pb);
+      uint32_t box_fourcc = avio_rl32(pb);
+
+      if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+        return AVERROR_INVALIDDATA;
+      if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc) {
+        avio_skip(pb, box_size - 8);
+        size -= box_size;
+        continue;
+      }
+
+      for (int j = 8; j < box_size; j += 2) {
+          pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF;
+          pkt->data[write_size+1] = avio_r8(pb);
+          pkt->data[write_size+2] = avio_r8(pb);
+          write_size += 3;
+      }
+
+      size -= box_size;
     }
 
+    av_shrink_packet(pkt, write_size);
+
     return 0;
 }
 
-- 
2.40.1