Mercurial > mplayer.hg
annotate libmpdemux/demux_smjpeg.c @ 22188:b9fa8b0ddab9
strncat() misuses, may have been exploitable.
Reported by Sascha Sommer.
author | rtogni |
---|---|
date | Sun, 11 Feb 2007 18:00:06 +0000 |
parents | d7b2fa4c39da |
children | 4d81dbdf46b9 |
rev | line source |
---|---|
7382 | 1 /* |
2 SMJPEG file parser by Alex Beregszaszi | |
3 | |
4 Only for testing some files. | |
5 Commited only for Nexus' request. | |
6 | |
7 Based on text by Arpi (SMJPEG-format.txt) and later on | |
8 http://www.lokigames.com/development/download/smjpeg/SMJPEG.txt | |
9 */ | |
10 | |
11 #include <stdio.h> | |
12 #include <stdlib.h> | |
13 #include <unistd.h> | |
14 #include <string.h> /* strtok */ | |
15 | |
16 #include "config.h" | |
17 #include "mp_msg.h" | |
18 #include "help_mp.h" | |
19 | |
20 #include "stream.h" | |
21 #include "demuxer.h" | |
22 #include "stheader.h" | |
23 | |
16175 | 24 static int smjpeg_check_file(demuxer_t* demuxer){ |
7382 | 25 int orig_pos = stream_tell(demuxer->stream); |
11109
084c271c785e
10l found by Mark Berryman <mplayer@theberrymans.com>
alex
parents:
7382
diff
changeset
|
26 char buf[8]; |
7382 | 27 int version; |
28 | |
29 mp_msg(MSGT_DEMUX, MSGL_V, "Checking for SMJPEG\n"); | |
30 | |
31 if (stream_read_word(demuxer->stream) == 0xA) | |
32 { | |
33 stream_read(demuxer->stream, buf, 6); | |
34 buf[7] = 0; | |
35 | |
36 if (strncmp("SMJPEG", buf, 6)) { | |
37 mp_msg(MSGT_DEMUX, MSGL_DBG2, "Failed: SMJPEG\n"); | |
38 return 0; | |
39 } | |
40 } | |
41 else | |
42 return 0; | |
43 | |
44 version = stream_read_dword(demuxer->stream); | |
45 if (version != 0) | |
46 { | |
47 mp_msg(MSGT_DEMUX, MSGL_ERR, "Unknown version (%d) of SMJPEG. Please report!\n", | |
48 version); | |
49 return 0; | |
50 } | |
51 | |
52 stream_seek(demuxer->stream, orig_pos); | |
53 | |
16175 | 54 return DEMUXER_TYPE_SMJPEG; |
7382 | 55 } |
56 | |
57 | |
58 // return value: | |
59 // 0 = EOF or no stream found | |
60 // 1 = successfully read a packet | |
16175 | 61 static int demux_smjpeg_fill_buffer(demuxer_t *demux, demux_stream_t *ds) |
7382 | 62 { |
63 int dtype, dsize, dpts; | |
64 | |
65 demux->filepos = stream_tell(demux->stream); | |
66 | |
67 dtype = stream_read_dword_le(demux->stream); | |
68 dpts = stream_read_dword(demux->stream); | |
69 dsize = stream_read_dword(demux->stream); | |
70 | |
71 switch(dtype) | |
72 { | |
73 case mmioFOURCC('s','n','d','D'): | |
74 /* fixme, but no decoder implemented yet */ | |
75 ds_read_packet(demux->audio, demux->stream, dsize, | |
76 (float)dpts/1000.0, demux->filepos, 0); | |
77 break; | |
78 case mmioFOURCC('v','i','d','D'): | |
79 ds_read_packet(demux->video, demux->stream, dsize, | |
80 (float)dpts/1000.0, demux->filepos, 0); | |
81 break; | |
82 case mmioFOURCC('D','O','N','E'): | |
83 return 1; | |
84 default: | |
85 return 0; | |
86 } | |
87 | |
88 return 1; | |
89 } | |
90 | |
16175 | 91 static demuxer_t* demux_open_smjpeg(demuxer_t* demuxer){ |
7382 | 92 sh_video_t* sh_video; |
93 sh_audio_t* sh_audio; | |
94 unsigned int htype = 0, hleng; | |
95 int i = 0; | |
96 | |
97 /* file header */ | |
98 stream_skip(demuxer->stream, 8); /* \x00\x0aSMJPEG */ | |
99 stream_skip(demuxer->stream, 4); | |
100 | |
101 mp_msg(MSGT_DEMUX, MSGL_INFO, "This clip is %d seconds\n", | |
102 stream_read_dword(demuxer->stream)); | |
103 | |
104 /* stream header */ | |
105 while (i < 3) | |
106 { | |
107 i++; | |
108 htype = stream_read_dword_le(demuxer->stream); | |
109 if (htype == mmioFOURCC('H','E','N','D')) | |
110 break; | |
111 hleng = (stream_read_word(demuxer->stream)<<16)|stream_read_word(demuxer->stream); | |
112 switch(htype) | |
113 { | |
114 case mmioFOURCC('_','V','I','D'): | |
115 sh_video = new_sh_video(demuxer, 0); | |
116 demuxer->video->sh = sh_video; | |
117 sh_video->ds = demuxer->video; | |
118 | |
119 sh_video->bih = malloc(sizeof(BITMAPINFOHEADER)); | |
120 memset(sh_video->bih, 0, sizeof(BITMAPINFOHEADER)); | |
121 | |
122 stream_skip(demuxer->stream, 4); /* number of frames */ | |
123 // sh_video->fps = 24; | |
124 // sh_video->frametime = 1.0f/sh_video->fps; | |
125 sh_video->disp_w = stream_read_word(demuxer->stream); | |
126 sh_video->disp_h = stream_read_word(demuxer->stream); | |
127 sh_video->format = stream_read_dword_le(demuxer->stream); | |
128 | |
129 /* these are false values */ | |
130 sh_video->bih->biSize = 40; | |
131 sh_video->bih->biWidth = sh_video->disp_w; | |
132 sh_video->bih->biHeight = sh_video->disp_h; | |
133 sh_video->bih->biPlanes = 3; | |
134 sh_video->bih->biBitCount = 12; | |
135 sh_video->bih->biCompression = sh_video->format; | |
136 sh_video->bih->biSizeImage = sh_video->disp_w*sh_video->disp_h; | |
137 break; | |
138 case mmioFOURCC('_','S','N','D'): | |
139 sh_audio = new_sh_audio(demuxer, 0); | |
140 demuxer->audio->sh = sh_audio; | |
141 sh_audio->ds = demuxer->audio; | |
142 | |
143 sh_audio->wf = malloc(sizeof(WAVEFORMATEX)); | |
144 memset(sh_audio->wf, 0, sizeof(WAVEFORMATEX)); | |
145 | |
146 sh_audio->samplerate = stream_read_word(demuxer->stream); | |
147 sh_audio->wf->wBitsPerSample = stream_read_char(demuxer->stream); | |
148 sh_audio->channels = stream_read_char(demuxer->stream); | |
149 sh_audio->format = stream_read_dword_le(demuxer->stream); | |
150 sh_audio->wf->wFormatTag = sh_audio->format; | |
151 sh_audio->wf->nChannels = sh_audio->channels; | |
152 sh_audio->wf->nSamplesPerSec = sh_audio->samplerate; | |
153 sh_audio->wf->nAvgBytesPerSec = sh_audio->wf->nChannels* | |
154 sh_audio->wf->wBitsPerSample*sh_audio->wf->nSamplesPerSec/8; | |
155 sh_audio->wf->nBlockAlign = sh_audio->channels *2; | |
156 sh_audio->wf->cbSize = 0; | |
157 break; | |
158 case mmioFOURCC('_','T','X','T'): | |
159 stream_skip(demuxer->stream, stream_read_dword(demuxer->stream)); | |
160 break; | |
161 } | |
162 } | |
163 | |
164 demuxer->seekable = 0; | |
165 | |
16175 | 166 return demuxer; |
7382 | 167 } |
168 | |
16175 | 169 static void demux_close_smjpeg(demuxer_t *demuxer) |
7382 | 170 { |
171 return; | |
172 } | |
16175 | 173 |
174 | |
175 demuxer_desc_t demuxer_desc_smjpeg = { | |
176 "smjpeg demuxer", | |
177 "smjpeg", | |
178 "SMJPEG", | |
179 "Alex Beregszasi", | |
180 "", | |
181 DEMUXER_TYPE_SMJPEG, | |
182 1, // safe autodetect | |
183 smjpeg_check_file, | |
184 demux_smjpeg_fill_buffer, | |
185 demux_open_smjpeg, | |
186 demux_close_smjpeg, | |
187 NULL, | |
188 NULL | |
189 }; |