ffmpeg/libavcodec/mjpeg_parser.c
Alex Xu (Hello71) cd0bdce71a avcodec/mjpeg_parser: skip markers after EOI, not by size
The check for m->size >= 0xF000 is intended to avoid skipping too much
garbage data between JPEG frames in test_roman (thus missing next SOI),
but it erroneously also skips valid markers between SOI and SOS. Instead
of this, we should simply skip parsing markers other than SOI after EOI.
That way, we will not accidentally skip over SOI due to some garbage
between frames. There is still a small risk of encountering FFD8 in the
garbage data, but the chance of this is fairly low.

Fixes: https://trac.ffmpeg.org/ticket/8967
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-11-27 18:24:49 +01:00

137 lines
3.9 KiB
C

/*
* MJPEG parser
* Copyright (c) 2000, 2001 Fabrice Bellard
* Copyright (c) 2003 Alex Beregszaszi
* Copyright (c) 2003-2004 Michael Niedermayer
*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/**
* @file
* MJPEG parser.
*/
#include "parser.h"
typedef struct MJPEGParserContext{
ParseContext pc;
int size;
}MJPEGParserContext;
/**
* Find the end of the current frame in the bitstream.
* @return the position of the first byte of the next frame, or -1
*/
static int find_frame_end(MJPEGParserContext *m, const uint8_t *buf, int buf_size){
ParseContext *pc= &m->pc;
int vop_found, i;
uint32_t state;
vop_found= pc->frame_start_found;
state= pc->state;
i=0;
if(!vop_found){
for(i=0; i<buf_size;){
state= (state<<8) | buf[i];
if(state>=0xFFC00000 && state<=0xFFFEFFFF){
if(state>=0xFFD8FFC0 && state<=0xFFD8FFFF){
i++;
vop_found=1;
break;
}else if(state<0xFFD00000 || state>0xFFD9FFFF){
m->size= (state&0xFFFF)-1;
}
}
if(m->size>0){
int size= FFMIN(buf_size-i, m->size);
i+=size;
m->size-=size;
state=0;
continue;
}else
i++;
}
}
if(vop_found){
/* EOF considered as end of frame */
if (buf_size == 0)
return 0;
for(; i<buf_size;){
state= (state<<8) | buf[i];
if(state>=0xFFC00000 && state<=0xFFFEFFFF){
if(state>=0xFFD8FFC0 && state<=0xFFD8FFFF){
pc->frame_start_found=0;
pc->state=0;
return i-3;
} else if((state>>16)==0xFFD9 && (state&0xFFFF)!=0xFFD8){
state= 0xFFD900|(state&0xFF);
} else if(state<0xFFD00000 || state>0xFFD9FFFF){
m->size= (state&0xFFFF)-1;
}
}
if(m->size>0){
int size= FFMIN(buf_size-i, m->size);
i+=size;
m->size-=size;
state=0;
continue;
}else
i++;
}
}
pc->frame_start_found= vop_found;
pc->state= state;
return END_NOT_FOUND;
}
static int jpeg_parse(AVCodecParserContext *s,
AVCodecContext *avctx,
const uint8_t **poutbuf, int *poutbuf_size,
const uint8_t *buf, int buf_size)
{
MJPEGParserContext *m = s->priv_data;
ParseContext *pc = &m->pc;
int next;
if(s->flags & PARSER_FLAG_COMPLETE_FRAMES){
next= buf_size;
}else{
next= find_frame_end(m, buf, buf_size);
if (ff_combine_frame(pc, next, &buf, &buf_size) < 0) {
*poutbuf = NULL;
*poutbuf_size = 0;
return buf_size;
}
}
*poutbuf = buf;
*poutbuf_size = buf_size;
return next;
}
const AVCodecParser ff_mjpeg_parser = {
.codec_ids = { AV_CODEC_ID_MJPEG, AV_CODEC_ID_JPEGLS },
.priv_data_size = sizeof(MJPEGParserContext),
.parser_parse = jpeg_parse,
.parser_close = ff_parse_close,
};