FFmpeg coverage

Line	Branch	Exec	Source
1			/*
2			* CDToons video decoder
3			* Copyright (C) 2020 Alyssa Milburn <amilburn@zall.org>
4			*
5			* This file is part of FFmpeg.
6			*
7			* FFmpeg is free software; you can redistribute it and/or
8			* modify it under the terms of the GNU Lesser General Public
9			* License as published by the Free Software Foundation; either
10			* version 2.1 of the License, or (at your option) any later version.
11			*
12			* FFmpeg is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15			* Lesser General Public License for more details.
16			*
17			* You should have received a copy of the GNU Lesser General Public
18			* License along with FFmpeg; if not, write to the Free Software
19			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20			*/
21
22			/**
23			* @file
24			* CDToons video decoder
25			* @author Alyssa Milburn <amilburn@zall.org>
26			*/
27
28			#include <stdint.h>
29
30			#include "libavutil/attributes.h"
31			#include "libavutil/internal.h"
32			#include "libavutil/mem.h"
33			#include "avcodec.h"
34			#include "bytestream.h"
35			#include "codec_internal.h"
36			#include "decode.h"
37
38			#define CDTOONS_HEADER_SIZE 44
39			#define CDTOONS_MAX_SPRITES 1200
40
41			typedef struct CDToonsSprite {
42			uint16_t flags;
43			uint16_t owner_frame;
44			uint16_t start_frame;
45			uint16_t end_frame;
46			unsigned int alloc_size;
47			uint32_t size;
48			uint8_t *data;
49			int active;
50			} CDToonsSprite;
51
52			typedef struct CDToonsContext {
53			AVFrame *frame;
54
55			uint16_t last_pal_id; ///< The index of the active palette sprite.
56			uint32_t pal[256]; ///< The currently-used palette data.
57			CDToonsSprite sprites[CDTOONS_MAX_SPRITES];
58			} CDToonsContext;
59
60		✗	static int cdtoons_render_sprite(AVCodecContext *avctx, const uint8_t *data,
61			uint32_t data_size,
62			int dst_x, int dst_y, int width, int height)
63			{
64		✗	CDToonsContext *c = avctx->priv_data;
65		✗	const uint8_t *next_line = data;
66		✗	const uint8_t *end = data + data_size;
67			uint16_t line_size;
68			uint8_t *dest;
69		✗	int skip = 0, to_skip, x;
70
71		✗	if (dst_x + width > avctx->width)
72		✗	width = avctx->width - dst_x;
73		✗	if (dst_y + height > avctx->height)
74		✗	height = avctx->height - dst_y;
75
76		✗	if (dst_x < 0) {
77			/* we need to skip the start of the scanlines */
78		✗	skip = -dst_x;
79		✗	if (width <= skip)
80		✗	return 0;
81		✗	dst_x = 0;
82			}
83
84		✗	for (int y = 0; y < height; y++) {
85			/* one scanline at a time, size is provided */
86		✗	data = next_line;
87		✗	if (end - data < 2)
88		✗	return 1;
89		✗	line_size = bytestream_get_be16(&data);
90		✗	if (end - data < line_size)
91		✗	return 1;
92		✗	next_line = data + line_size;
93		✗	if (dst_y + y < 0)
94		✗	continue;
95
96		✗	dest = c->frame->data[0] + (dst_y + y) * c->frame->linesize[0] + dst_x;
97
98		✗	to_skip = skip;
99		✗	x = 0;
100		✗	while (x < width - skip) {
101			int raw, size, step;
102			uint8_t val;
103
104		✗	if (data >= end)
105		✗	return 1;
106
107		✗	val = bytestream_get_byte(&data);
108		✗	raw = !(val & 0x80);
109		✗	size = (int)(val & 0x7F) + 1;
110
111			/* skip the start of a scanline if it is off-screen */
112		✗	if (to_skip >= size) {
113		✗	to_skip -= size;
114		✗	if (raw) {
115		✗	step = size;
116			} else {
117		✗	step = 1;
118			}
119		✗	if (next_line - data < step)
120		✗	return 1;
121		✗	data += step;
122		✗	continue;
123		✗	} else if (to_skip) {
124		✗	size -= to_skip;
125		✗	if (raw) {
126		✗	if (next_line - data < to_skip)
127		✗	return 1;
128		✗	data += to_skip;
129			}
130		✗	to_skip = 0;
131			}
132
133		✗	if (x + size >= width - skip)
134		✗	size = width - skip - x;
135
136			/* either raw data, or a run of a single color */
137		✗	if (raw) {
138		✗	if (next_line - data < size)
139		✗	return 1;
140		✗	memcpy(dest + x, data, size);
141		✗	data += size;
142			} else {
143		✗	uint8_t color = bytestream_get_byte(&data);
144			/* ignore transparent runs */
145		✗	if (color)
146		✗	memset(dest + x, color, size);
147			}
148		✗	x += size;
149			}
150			}
151
152		✗	return 0;
153			}
154
155		✗	static int cdtoons_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
156			int *got_frame, AVPacket *avpkt)
157			{
158		✗	CDToonsContext *c = avctx->priv_data;
159		✗	const uint8_t *buf = avpkt->data;
160		✗	const uint8_t *eod = avpkt->data + avpkt->size;
161		✗	const int buf_size = avpkt->size;
162			uint16_t frame_id;
163			uint8_t background_color;
164			uint16_t sprite_count, sprite_offset;
165			uint8_t referenced_count;
166			uint16_t palette_id;
167			uint8_t palette_set;
168			int ret;
169		✗	int saw_embedded_sprites = 0;
170
171		✗	if (buf_size < CDTOONS_HEADER_SIZE)
172		✗	return AVERROR_INVALIDDATA;
173
174		✗	if ((ret = ff_reget_buffer(avctx, c->frame, 0)) < 0)
175		✗	return ret;
176
177			/* a lot of the header is useless junk in the absence of
178			* dirty rectangling etc */
179		✗	buf += 2; /* version? (always 9?) */
180		✗	frame_id = bytestream_get_be16(&buf);
181		✗	buf += 2; /* blocks_valid_until */
182		✗	buf += 1;
183		✗	background_color = bytestream_get_byte(&buf);
184		✗	buf += 16; /* clip rect, dirty rect */
185		✗	buf += 4; /* flags */
186		✗	sprite_count = bytestream_get_be16(&buf);
187		✗	sprite_offset = bytestream_get_be16(&buf);
188		✗	buf += 2; /* max block id? */
189		✗	referenced_count = bytestream_get_byte(&buf);
190		✗	buf += 1;
191		✗	palette_id = bytestream_get_be16(&buf);
192		✗	palette_set = bytestream_get_byte(&buf);
193		✗	buf += 5;
194
195		✗	if (sprite_offset > buf_size)
196		✗	return AVERROR_INVALIDDATA;
197
198			/* read new sprites introduced in this frame */
199		✗	buf = avpkt->data + sprite_offset;
200		✗	while (sprite_count--) {
201			uint32_t size;
202			uint16_t sprite_id;
203
204		✗	if (buf + 14 > eod)
205		✗	return AVERROR_INVALIDDATA;
206
207		✗	sprite_id = bytestream_get_be16(&buf);
208		✗	if (sprite_id >= CDTOONS_MAX_SPRITES) {
209		✗	av_log(avctx, AV_LOG_ERROR,
210			"Sprite ID %d is too high.\n", sprite_id);
211		✗	return AVERROR_INVALIDDATA;
212			}
213		✗	if (c->sprites[sprite_id].active) {
214		✗	av_log(avctx, AV_LOG_ERROR,
215			"Sprite ID %d is a duplicate.\n", sprite_id);
216		✗	return AVERROR_INVALIDDATA;
217			}
218
219		✗	c->sprites[sprite_id].flags = bytestream_get_be16(&buf);
220		✗	size = bytestream_get_be32(&buf);
221		✗	if (size < 14) {
222		✗	av_log(avctx, AV_LOG_ERROR,
223			"Sprite only has %d bytes of data.\n", size);
224		✗	return AVERROR_INVALIDDATA;
225			}
226		✗	size -= 14;
227		✗	c->sprites[sprite_id].size = size;
228		✗	c->sprites[sprite_id].owner_frame = frame_id;
229		✗	c->sprites[sprite_id].start_frame = bytestream_get_be16(&buf);
230		✗	c->sprites[sprite_id].end_frame = bytestream_get_be16(&buf);
231		✗	buf += 2;
232
233		✗	if (size > buf_size || buf + size > eod)
234		✗	return AVERROR_INVALIDDATA;
235
236		✗	av_fast_padded_malloc(&c->sprites[sprite_id].data, &c->sprites[sprite_id].alloc_size, size);
237		✗	if (!c->sprites[sprite_id].data)
238		✗	return AVERROR(ENOMEM);
239
240		✗	c->sprites[sprite_id].active = 1;
241
242		✗	bytestream_get_buffer(&buf, c->sprites[sprite_id].data, size);
243			}
244
245			/* render any embedded sprites */
246		✗	while (buf < eod) {
247			uint32_t tag, size;
248		✗	if (buf + 8 > eod) {
249		✗	av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for embedded sprites.\n");
250		✗	return AVERROR_INVALIDDATA;
251			}
252		✗	tag = bytestream_get_be32(&buf);
253		✗	size = bytestream_get_be32(&buf);
254		✗	if (tag == MKBETAG('D', 'i', 'f', 'f')) {
255			uint16_t diff_count;
256		✗	if (buf + 10 > eod) {
257		✗	av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame.\n");
258		✗	return AVERROR_INVALIDDATA;
259			}
260		✗	diff_count = bytestream_get_be16(&buf);
261		✗	buf += 8; /* clip rect? */
262		✗	for (int i = 0; i < diff_count; i++) {
263			int16_t top, left;
264			uint16_t diff_size, width, height;
265
266		✗	if (buf + 16 > eod) {
267		✗	av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame header.\n");
268		✗	return AVERROR_INVALIDDATA;
269			}
270
271		✗	top = bytestream_get_be16(&buf);
272		✗	left = bytestream_get_be16(&buf);
273		✗	buf += 4; /* bottom, right */
274		✗	diff_size = bytestream_get_be32(&buf);
275		✗	width = bytestream_get_be16(&buf);
276		✗	height = bytestream_get_be16(&buf);
277		✗	if (diff_size < 8 || diff_size - 4 > eod - buf) {
278		✗	av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame data.\n");
279		✗	return AVERROR_INVALIDDATA;
280			}
281		✗	if (cdtoons_render_sprite(avctx, buf + 4, diff_size - 8,
282			left, top, width, height)) {
283		✗	av_log(avctx, AV_LOG_WARNING, "Ran beyond end of sprite while rendering.\n");
284			}
285		✗	buf += diff_size - 4;
286			}
287		✗	saw_embedded_sprites = 1;
288			} else {
289			/* we don't care about any other entries */
290		✗	if (size < 8 || size - 8 > eod - buf) {
291		✗	av_log(avctx, AV_LOG_WARNING, "Ran out of data for ignored entry (size %X, %d left).\n", size, (int)(eod - buf));
292		✗	return AVERROR_INVALIDDATA;
293			}
294		✗	buf += (size - 8);
295			}
296			}
297
298			/* was an intra frame? */
299		✗	if (saw_embedded_sprites)
300		✗	goto done;
301
302			/* render any referenced sprites */
303		✗	buf = avpkt->data + CDTOONS_HEADER_SIZE;
304		✗	eod = avpkt->data + sprite_offset;
305		✗	for (int i = 0; i < referenced_count; i++) {
306			const uint8_t *block_data;
307			uint16_t sprite_id, width, height;
308			int16_t top, left, right;
309
310		✗	if (buf + 10 > eod) {
311		✗	av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data when rendering.\n");
312		✗	return AVERROR_INVALIDDATA;
313			}
314
315		✗	sprite_id = bytestream_get_be16(&buf);
316		✗	top = bytestream_get_be16(&buf);
317		✗	left = bytestream_get_be16(&buf);
318		✗	buf += 2; /* bottom */
319		✗	right = bytestream_get_be16(&buf);
320
321		✗	if ((i == 0) && (sprite_id == 0)) {
322			/* clear background */
323		✗	memset(c->frame->data[0], background_color,
324		✗	c->frame->linesize[0] * avctx->height);
325			}
326
327		✗	if (!right)
328		✗	continue;
329		✗	if (sprite_id >= CDTOONS_MAX_SPRITES) {
330		✗	av_log(avctx, AV_LOG_ERROR,
331			"Sprite ID %d is too high.\n", sprite_id);
332		✗	return AVERROR_INVALIDDATA;
333			}
334
335		✗	block_data = c->sprites[sprite_id].data;
336		✗	if (!c->sprites[sprite_id].active) {
337			/* this can happen when seeking around */
338		✗	av_log(avctx, AV_LOG_WARNING, "Sprite %d is missing.\n", sprite_id);
339		✗	continue;
340			}
341		✗	if (c->sprites[sprite_id].size < 14) {
342		✗	av_log(avctx, AV_LOG_ERROR, "Sprite %d is too small.\n", sprite_id);
343		✗	continue;
344			}
345
346		✗	height = bytestream_get_be16(&block_data);
347		✗	width = bytestream_get_be16(&block_data);
348		✗	block_data += 10;
349		✗	if (cdtoons_render_sprite(avctx, block_data,
350		✗	c->sprites[sprite_id].size - 14,
351			left, top, width, height)) {
352		✗	av_log(avctx, AV_LOG_WARNING, "Ran beyond end of sprite while rendering.\n");
353			}
354			}
355
356		✗	if (palette_id && (palette_id != c->last_pal_id)) {
357		✗	if (palette_id >= CDTOONS_MAX_SPRITES) {
358		✗	av_log(avctx, AV_LOG_ERROR,
359			"Palette ID %d is too high.\n", palette_id);
360		✗	return AVERROR_INVALIDDATA;
361			}
362		✗	if (!c->sprites[palette_id].active) {
363			/* this can happen when seeking around */
364		✗	av_log(avctx, AV_LOG_WARNING,
365			"Palette ID %d is missing.\n", palette_id);
366		✗	goto done;
367			}
368		✗	if (c->sprites[palette_id].size != 256 * 2 * 3) {
369		✗	av_log(avctx, AV_LOG_ERROR,
370			"Palette ID %d is wrong size (%d).\n",
371			palette_id, c->sprites[palette_id].size);
372		✗	return AVERROR_INVALIDDATA;
373			}
374		✗	c->last_pal_id = palette_id;
375		✗	if (!palette_set) {
376		✗	uint8_t *palette_data = c->sprites[palette_id].data;
377		✗	for (int i = 0; i < 256; i++) {
378			/* QuickTime-ish palette: 16-bit RGB components */
379			unsigned r, g, b;
380		✗	r = *palette_data;
381		✗	g = *(palette_data + 2);
382		✗	b = *(palette_data + 4);
383		✗	c->pal[i] = (0xFFU << 24) | (r << 16) | (g << 8) | b;
384		✗	palette_data += 6;
385			}
386			/* first palette entry indicates transparency */
387		✗	c->pal[0] = 0;
388			}
389			}
390
391		✗	done:
392			/* discard outdated blocks */
393		✗	for (int i = 0; i < CDTOONS_MAX_SPRITES; i++) {
394		✗	if (c->sprites[i].end_frame > frame_id)
395		✗	continue;
396		✗	c->sprites[i].active = 0;
397			}
398
399		✗	memcpy(c->frame->data[1], c->pal, AVPALETTE_SIZE);
400
401		✗	if ((ret = av_frame_ref(rframe, c->frame)) < 0)
402		✗	return ret;
403
404		✗	*got_frame = 1;
405
406			/* always report that the buffer was completely consumed */
407		✗	return buf_size;
408			}
409
410		✗	static av_cold int cdtoons_decode_init(AVCodecContext *avctx)
411			{
412		✗	CDToonsContext *c = avctx->priv_data;
413
414		✗	avctx->pix_fmt = AV_PIX_FMT_PAL8;
415		✗	c->last_pal_id = 0;
416		✗	c->frame = av_frame_alloc();
417		✗	if (!c->frame)
418		✗	return AVERROR(ENOMEM);
419
420		✗	return 0;
421			}
422
423		✗	static av_cold void cdtoons_flush(AVCodecContext *avctx)
424			{
425		✗	CDToonsContext *c = avctx->priv_data;
426
427		✗	c->last_pal_id = 0;
428		✗	for (int i = 0; i < CDTOONS_MAX_SPRITES; i++)
429		✗	c->sprites[i].active = 0;
430		✗	}
431
432		✗	static av_cold int cdtoons_decode_end(AVCodecContext *avctx)
433			{
434		✗	CDToonsContext *c = avctx->priv_data;
435
436		✗	for (int i = 0; i < CDTOONS_MAX_SPRITES; i++) {
437		✗	av_freep(&c->sprites[i].data);
438		✗	c->sprites[i].active = 0;
439			}
440
441		✗	av_frame_free(&c->frame);
442
443		✗	return 0;
444			}
445
446			const FFCodec ff_cdtoons_decoder = {
447			.p.name = "cdtoons",
448			CODEC_LONG_NAME("CDToons video"),
449			.p.type = AVMEDIA_TYPE_VIDEO,
450			.p.id = AV_CODEC_ID_CDTOONS,
451			.priv_data_size = sizeof(CDToonsContext),
452			.init = cdtoons_decode_init,
453			.close = cdtoons_decode_end,
454			FF_CODEC_DECODE_CB(cdtoons_decode_frame),
455			.p.capabilities = AV_CODEC_CAP_DR1,
456			.flush = cdtoons_flush,
457			};
458