GCC Code Coverage Report
Directory: ../../../ffmpeg/ Exec Total Coverage
File: src/libavcodec/cdtoons.c Lines: 0 235 0.0 %
Date: 2020-11-28 20:53:16 Branches: 0 130 0.0 %

Line Branch Exec Source
1
/*
2
 * CDToons video decoder
3
 * Copyright (C) 2020 Alyssa Milburn <amilburn@zall.org>
4
 *
5
 * This file is part of FFmpeg.
6
 *
7
 * FFmpeg is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * FFmpeg is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with FFmpeg; if not, write to the Free Software
19
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20
 */
21
22
/**
23
 * @file
24
 * CDToons video decoder
25
 * @author Alyssa Milburn <amilburn@zall.org>
26
 */
27
28
#include <stdint.h>
29
30
#include "libavutil/attributes.h"
31
#include "libavutil/internal.h"
32
#include "avcodec.h"
33
#include "bytestream.h"
34
#include "internal.h"
35
36
#define CDTOONS_HEADER_SIZE   44
37
#define CDTOONS_MAX_SPRITES 1200
38
39
typedef struct CDToonsSprite {
40
    uint16_t flags;
41
    uint16_t owner_frame;
42
    uint16_t start_frame;
43
    uint16_t end_frame;
44
    unsigned int alloc_size;
45
    uint32_t size;
46
    uint8_t *data;
47
    int      active;
48
} CDToonsSprite;
49
50
typedef struct CDToonsContext {
51
    AVFrame *frame;
52
53
    uint16_t last_pal_id;   ///< The index of the active palette sprite.
54
    uint32_t pal[256];      ///< The currently-used palette data.
55
    CDToonsSprite sprites[CDTOONS_MAX_SPRITES];
56
} CDToonsContext;
57
58
static int cdtoons_render_sprite(AVCodecContext *avctx, const uint8_t *data,
59
                                 uint32_t data_size,
60
                                 int dst_x, int dst_y, int width, int height)
61
{
62
    CDToonsContext *c = avctx->priv_data;
63
    const uint8_t *next_line = data;
64
    const uint8_t *end = data + data_size;
65
    uint16_t line_size;
66
    uint8_t *dest;
67
    int skip = 0, to_skip, x;
68
69
    if (dst_x + width > avctx->width)
70
        width = avctx->width - dst_x;
71
    if (dst_y + height > avctx->height)
72
        height = avctx->height - dst_y;
73
74
    if (dst_x < 0) {
75
        /* we need to skip the start of the scanlines */
76
        skip = -dst_x;
77
        if (width <= skip)
78
            return 0;
79
        dst_x = 0;
80
    }
81
82
    for (int y = 0; y < height; y++) {
83
        /* one scanline at a time, size is provided */
84
        data      = next_line;
85
        if (end - data < 2)
86
            return 1;
87
        line_size = bytestream_get_be16(&data);
88
        if (end - data < line_size)
89
            return 1;
90
        next_line = data + line_size;
91
        if (dst_y + y < 0)
92
            continue;
93
94
        dest = c->frame->data[0] + (dst_y + y) * c->frame->linesize[0] + dst_x;
95
96
        to_skip = skip;
97
        x       = 0;
98
        while (x < width - skip) {
99
            int raw, size, step;
100
            uint8_t val;
101
102
            if (data >= end)
103
                return 1;
104
105
            val  = bytestream_get_byte(&data);
106
            raw  = !(val & 0x80);
107
            size = (int)(val & 0x7F) + 1;
108
109
            /* skip the start of a scanline if it is off-screen */
110
            if (to_skip >= size) {
111
                to_skip -= size;
112
                if (raw) {
113
                    step = size;
114
                } else {
115
                    step = 1;
116
                }
117
                if (next_line - data < step)
118
                    return 1;
119
                data += step;
120
                continue;
121
            } else if (to_skip) {
122
                size -= to_skip;
123
                if (raw) {
124
                    if (next_line - data < to_skip)
125
                        return 1;
126
                    data += to_skip;
127
                }
128
                to_skip = 0;
129
            }
130
131
            if (x + size >= width - skip)
132
                size = width - skip - x;
133
134
            /* either raw data, or a run of a single color */
135
            if (raw) {
136
                if (next_line - data < size)
137
                    return 1;
138
                memcpy(dest + x, data, size);
139
                data += size;
140
            } else {
141
                uint8_t color = bytestream_get_byte(&data);
142
                /* ignore transparent runs */
143
                if (color)
144
                    memset(dest + x, color, size);
145
            }
146
            x += size;
147
        }
148
    }
149
150
    return 0;
151
}
152
153
static int cdtoons_decode_frame(AVCodecContext *avctx, void *data,
154
                                int *got_frame, AVPacket *avpkt)
155
{
156
    CDToonsContext *c = avctx->priv_data;
157
    const uint8_t *buf = avpkt->data;
158
    const uint8_t *eod = avpkt->data + avpkt->size;
159
    const int buf_size = avpkt->size;
160
    uint16_t frame_id;
161
    uint8_t background_color;
162
    uint16_t sprite_count, sprite_offset;
163
    uint8_t referenced_count;
164
    uint16_t palette_id;
165
    uint8_t palette_set;
166
    int ret;
167
    int saw_embedded_sprites = 0;
168
169
    if (buf_size < CDTOONS_HEADER_SIZE)
170
        return AVERROR_INVALIDDATA;
171
172
    if ((ret = ff_reget_buffer(avctx, c->frame, 0)) < 0)
173
        return ret;
174
175
    /* a lot of the header is useless junk in the absence of
176
     * dirty rectangling etc */
177
    buf               += 2; /* version? (always 9?) */
178
    frame_id           = bytestream_get_be16(&buf);
179
    buf               += 2; /* blocks_valid_until */
180
    buf               += 1;
181
    background_color   = bytestream_get_byte(&buf);
182
    buf               += 16; /* clip rect, dirty rect */
183
    buf               += 4; /* flags */
184
    sprite_count       = bytestream_get_be16(&buf);
185
    sprite_offset      = bytestream_get_be16(&buf);
186
    buf               += 2; /* max block id? */
187
    referenced_count   = bytestream_get_byte(&buf);
188
    buf               += 1;
189
    palette_id         = bytestream_get_be16(&buf);
190
    palette_set        = bytestream_get_byte(&buf);
191
    buf               += 5;
192
193
    if (sprite_offset > buf_size)
194
        return AVERROR_INVALIDDATA;
195
196
    /* read new sprites introduced in this frame */
197
    buf = avpkt->data + sprite_offset;
198
    while (sprite_count--) {
199
        uint32_t size;
200
        uint16_t sprite_id;
201
202
        if (buf + 14 > eod)
203
            return AVERROR_INVALIDDATA;
204
205
        sprite_id = bytestream_get_be16(&buf);
206
        if (sprite_id >= CDTOONS_MAX_SPRITES) {
207
            av_log(avctx, AV_LOG_ERROR,
208
                   "Sprite ID %d is too high.\n", sprite_id);
209
            return AVERROR_INVALIDDATA;
210
        }
211
        if (c->sprites[sprite_id].active) {
212
            av_log(avctx, AV_LOG_ERROR,
213
                   "Sprite ID %d is a duplicate.\n", sprite_id);
214
            return AVERROR_INVALIDDATA;
215
        }
216
217
        c->sprites[sprite_id].flags = bytestream_get_be16(&buf);
218
        size                        = bytestream_get_be32(&buf);
219
        if (size < 14) {
220
            av_log(avctx, AV_LOG_ERROR,
221
                   "Sprite only has %d bytes of data.\n", size);
222
            return AVERROR_INVALIDDATA;
223
        }
224
        size -= 14;
225
        c->sprites[sprite_id].size        = size;
226
        c->sprites[sprite_id].owner_frame = frame_id;
227
        c->sprites[sprite_id].start_frame = bytestream_get_be16(&buf);
228
        c->sprites[sprite_id].end_frame   = bytestream_get_be16(&buf);
229
        buf += 2;
230
231
        if (size > buf_size || buf + size > eod)
232
            return AVERROR_INVALIDDATA;
233
234
        av_fast_padded_malloc(&c->sprites[sprite_id].data, &c->sprites[sprite_id].alloc_size, size);
235
        if (!c->sprites[sprite_id].data)
236
            return AVERROR(ENOMEM);
237
238
        c->sprites[sprite_id].active = 1;
239
240
        bytestream_get_buffer(&buf, c->sprites[sprite_id].data, size);
241
    }
242
243
    /* render any embedded sprites */
244
    while (buf < eod) {
245
        uint32_t tag, size;
246
        if (buf + 8 > eod) {
247
            av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for embedded sprites.\n");
248
            return AVERROR_INVALIDDATA;
249
        }
250
        tag  = bytestream_get_be32(&buf);
251
        size = bytestream_get_be32(&buf);
252
        if (tag == MKBETAG('D', 'i', 'f', 'f')) {
253
            uint16_t diff_count;
254
            if (buf + 10 > eod) {
255
                av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame.\n");
256
                return AVERROR_INVALIDDATA;
257
            }
258
            diff_count = bytestream_get_be16(&buf);
259
            buf       += 8; /* clip rect? */
260
            for (int i = 0; i < diff_count; i++) {
261
                int16_t top, left;
262
                uint16_t diff_size, width, height;
263
264
                if (buf + 16 > eod) {
265
                    av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame header.\n");
266
                    return AVERROR_INVALIDDATA;
267
                }
268
269
                top        = bytestream_get_be16(&buf);
270
                left       = bytestream_get_be16(&buf);
271
                buf       += 4; /* bottom, right */
272
                diff_size  = bytestream_get_be32(&buf);
273
                width      = bytestream_get_be16(&buf);
274
                height     = bytestream_get_be16(&buf);
275
                if (diff_size < 8 || diff_size - 4 > eod - buf) {
276
                    av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame data.\n");
277
                    return AVERROR_INVALIDDATA;
278
                }
279
                if (cdtoons_render_sprite(avctx, buf + 4, diff_size - 8,
280
                                      left, top, width, height)) {
281
                    av_log(avctx, AV_LOG_WARNING, "Ran beyond end of sprite while rendering.\n");
282
                }
283
                buf += diff_size - 4;
284
            }
285
            saw_embedded_sprites = 1;
286
        } else {
287
            /* we don't care about any other entries */
288
            if (size < 8 || size - 8 > eod - buf) {
289
                av_log(avctx, AV_LOG_WARNING, "Ran out of data for ignored entry (size %X, %d left).\n", size, (int)(eod - buf));
290
                return AVERROR_INVALIDDATA;
291
            }
292
            buf += (size - 8);
293
        }
294
    }
295
296
    /* was an intra frame? */
297
    if (saw_embedded_sprites)
298
        goto done;
299
300
    /* render any referenced sprites */
301
    buf = avpkt->data + CDTOONS_HEADER_SIZE;
302
    eod = avpkt->data + sprite_offset;
303
    for (int i = 0; i < referenced_count; i++) {
304
        const uint8_t *block_data;
305
        uint16_t sprite_id, width, height;
306
        int16_t top, left, right;
307
308
        if (buf + 10 > eod) {
309
            av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data when rendering.\n");
310
            return AVERROR_INVALIDDATA;
311
        }
312
313
        sprite_id = bytestream_get_be16(&buf);
314
        top       = bytestream_get_be16(&buf);
315
        left      = bytestream_get_be16(&buf);
316
        buf      += 2; /* bottom */
317
        right     = bytestream_get_be16(&buf);
318
319
        if ((i == 0) && (sprite_id == 0)) {
320
            /* clear background */
321
            memset(c->frame->data[0], background_color,
322
                   c->frame->linesize[0] * avctx->height);
323
        }
324
325
        if (!right)
326
            continue;
327
        if (sprite_id >= CDTOONS_MAX_SPRITES) {
328
            av_log(avctx, AV_LOG_ERROR,
329
                   "Sprite ID %d is too high.\n", sprite_id);
330
            return AVERROR_INVALIDDATA;
331
        }
332
333
        block_data = c->sprites[sprite_id].data;
334
        if (!c->sprites[sprite_id].active) {
335
            /* this can happen when seeking around */
336
            av_log(avctx, AV_LOG_WARNING, "Sprite %d is missing.\n", sprite_id);
337
            continue;
338
        }
339
        if (c->sprites[sprite_id].size < 14) {
340
            av_log(avctx, AV_LOG_ERROR, "Sprite %d is too small.\n", sprite_id);
341
            continue;
342
        }
343
344
        height      = bytestream_get_be16(&block_data);
345
        width       = bytestream_get_be16(&block_data);
346
        block_data += 10;
347
        if (cdtoons_render_sprite(avctx, block_data,
348
                              c->sprites[sprite_id].size - 14,
349
                              left, top, width, height)) {
350
            av_log(avctx, AV_LOG_WARNING, "Ran beyond end of sprite while rendering.\n");
351
        }
352
    }
353
354
    if (palette_id && (palette_id != c->last_pal_id)) {
355
        if (palette_id >= CDTOONS_MAX_SPRITES) {
356
            av_log(avctx, AV_LOG_ERROR,
357
                   "Palette ID %d is too high.\n", palette_id);
358
            return AVERROR_INVALIDDATA;
359
        }
360
        if (!c->sprites[palette_id].active) {
361
            /* this can happen when seeking around */
362
            av_log(avctx, AV_LOG_WARNING,
363
                   "Palette ID %d is missing.\n", palette_id);
364
            goto done;
365
        }
366
        if (c->sprites[palette_id].size != 256 * 2 * 3) {
367
            av_log(avctx, AV_LOG_ERROR,
368
                   "Palette ID %d is wrong size (%d).\n",
369
                   palette_id, c->sprites[palette_id].size);
370
            return AVERROR_INVALIDDATA;
371
        }
372
        c->last_pal_id = palette_id;
373
        if (!palette_set) {
374
            uint8_t *palette_data = c->sprites[palette_id].data;
375
            for (int i = 0; i < 256; i++) {
376
                /* QuickTime-ish palette: 16-bit RGB components */
377
                unsigned r, g, b;
378
                r             = *palette_data;
379
                g             = *(palette_data + 2);
380
                b             = *(palette_data + 4);
381
                c->pal[i]     = (0xFFU << 24) | (r << 16) | (g << 8) | b;
382
                palette_data += 6;
383
            }
384
            /* first palette entry indicates transparency */
385
            c->pal[0]                     = 0;
386
            c->frame->palette_has_changed = 1;
387
        }
388
    }
389
390
done:
391
    /* discard outdated blocks */
392
    for (int i = 0; i < CDTOONS_MAX_SPRITES; i++) {
393
        if (c->sprites[i].end_frame > frame_id)
394
            continue;
395
        c->sprites[i].active = 0;
396
    }
397
398
    memcpy(c->frame->data[1], c->pal, AVPALETTE_SIZE);
399
400
    if ((ret = av_frame_ref(data, c->frame)) < 0)
401
        return ret;
402
403
    *got_frame = 1;
404
405
    /* always report that the buffer was completely consumed */
406
    return buf_size;
407
}
408
409
static av_cold int cdtoons_decode_init(AVCodecContext *avctx)
410
{
411
    CDToonsContext *c = avctx->priv_data;
412
413
    avctx->pix_fmt = AV_PIX_FMT_PAL8;
414
    c->last_pal_id = 0;
415
    c->frame       = av_frame_alloc();
416
    if (!c->frame)
417
        return AVERROR(ENOMEM);
418
419
    return 0;
420
}
421
422
static void cdtoons_flush(AVCodecContext *avctx)
423
{
424
    CDToonsContext *c = avctx->priv_data;
425
426
    c->last_pal_id = 0;
427
    for (int i = 0; i < CDTOONS_MAX_SPRITES; i++)
428
        c->sprites[i].active = 0;
429
}
430
431
static av_cold int cdtoons_decode_end(AVCodecContext *avctx)
432
{
433
    CDToonsContext *c = avctx->priv_data;
434
435
    for (int i = 0; i < CDTOONS_MAX_SPRITES; i++) {
436
        av_freep(&c->sprites[i].data);
437
        c->sprites[i].active = 0;
438
    }
439
440
    av_frame_free(&c->frame);
441
442
    return 0;
443
}
444
445
AVCodec ff_cdtoons_decoder = {
446
    .name           = "cdtoons",
447
    .long_name      = NULL_IF_CONFIG_SMALL("CDToons video"),
448
    .type           = AVMEDIA_TYPE_VIDEO,
449
    .id             = AV_CODEC_ID_CDTOONS,
450
    .priv_data_size = sizeof(CDToonsContext),
451
    .init           = cdtoons_decode_init,
452
    .close          = cdtoons_decode_end,
453
    .decode         = cdtoons_decode_frame,
454
    .capabilities   = AV_CODEC_CAP_DR1,
455
    .flush          = cdtoons_flush,
456
};