FFmpeg coverage

Directory: ../../../ffmpeg/
File: src/libavformat/tests/id3v2chap.c
Date: 2026-10-29 23:19:09
Exec Total Coverage
Lines: 117 129 90.7%
Functions: 3 3 100.0%
Branches: 42 64 65.6%
Line Branch Exec Source
1 /*
2 * Copyright (c) 2026 Jun Zhao
3 *
4 * This file is part of FFmpeg.
5 *
6 * FFmpeg is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * FFmpeg is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with FFmpeg; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #include <inttypes.h>
22 #include <stdio.h>
23 #include <string.h>
24
25 #include "libavutil/mem.h"
26 #include "libavformat/avformat.h"
27 #include "libavformat/avio_internal.h"
28 #include "libavformat/demux.h"
29 #include "libavformat/id3v2.h"
30
31 11 static int readback(const uint8_t *buf, int size)
32 {
33 11 AVFormatContext *in = avformat_alloc_context();
34 FFIOContext read_pb;
35 11 ID3v2ExtraMeta *extra = NULL;
36 11 AVDictionary *meta = NULL;
37 const AVDictionaryEntry *album;
38 11 int ret = 1;
39
40
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 11 times.
 11 if (!in)
41 ✗ return ret;
42
43 11 ffio_init_read_context(&read_pb, buf, size);
44 11 ff_id3v2_read_dict(in, &read_pb.pub, &meta, ID3v2_DEFAULT_MAGIC, &extra);
45
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 11 times.
 11 if (ff_id3v2_parse_chapters(in, extra) < 0)
46 ✗ goto done;
47
48 11 printf("chapters=%u", in->nb_chapters);
49 11 album = av_dict_get(meta, "album", NULL, 0);
50
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 10 times.
 11 if (album)
51 1 printf(" album=%s", album->value);
52 11 printf("\n");
53
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 11 times.
 33 for (unsigned i = 0; i < in->nb_chapters; i++) {
54 22 const AVChapter *ch = in->chapters[i];
55 22 const AVDictionaryEntry *title = av_dict_get(ch->metadata, "title", NULL, 0);
56 22 const AVDictionaryEntry *artist = av_dict_get(ch->metadata, "artist", NULL, 0);
57
58
1/2
✓ Branch 0 taken 22 times.
✗ Branch 1 not taken.
 22 printf("chapter=%u time_base=%d/%d start=%"PRId64" end=%"PRId64" title=%s",
59 22 i, ch->time_base.num, ch->time_base.den, ch->start, ch->end,
60 title ? title->value : "(missing)");
61
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 20 times.
 22 if (artist)
62 2 printf(" artist=%s", artist->value);
63 22 printf("\n");
64 }
65 11 ret = 0;
66
67 11 done:
68 11 av_dict_free(&meta);
69 11 ff_id3v2_free_extra_meta(&extra);
70 11 avformat_free_context(in);
71 11 return ret;
72 }
73
74 /* The first chapter title is long enough that its TIT2 frame is at least
75 * 128 bytes, so a plain size and a synchsafe size differ. */
76 3 static int roundtrip(int version, int ambiguous)
77 {
78 char long_title[225];
79
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 int title_len = ambiguous ? 224 : 150;
80 3 AVFormatContext *out = NULL;
81 3 AVIOContext *pb = NULL;
82 3 ID3v2EncContext id3 = { 0 };
83 3 uint8_t *buf = NULL;
84 3 int size, chap_pos = -1, ret = 1;
85
86 3 memset(long_title, 'L', title_len);
87 3 long_title[title_len] = 0;
88
89 3 out = avformat_alloc_context();
90
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
 6 if (!out ||
91
1/2
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
 6 !avpriv_new_chapter(out, 0, av_make_q(1, 1000), 0, 1000, long_title) ||
92
1/2
✗ Branch 2 not taken.
✓ Branch 3 taken 3 times.
 6 !avpriv_new_chapter(out, 1, av_make_q(1, 1000), 1000, 2000, "End") ||
93 3 avio_open_dyn_buf(&pb) < 0)
94 ✗ goto done;
95
96 3 ff_id3v2_start(&id3, pb, version, ID3v2_DEFAULT_MAGIC);
97
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
 3 if (ff_id3v2_write_metadata(out, pb, &id3) < 0)
98 ✗ goto done;
99
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 ff_id3v2_finish(&id3, pb, ambiguous ? 300 : 10);
100 3 size = avio_close_dyn_buf(pb, &buf);
101 3 pb = NULL;
102
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (size < ID3v2_HEADER_SIZE)
103 ✗ goto done;
104
105 3 printf("version=%d declared=%d actual=%d\n", version, ff_id3v2_tag_len(buf), size);
106
1/2
✓ Branch 0 taken 105 times.
✗ Branch 1 not taken.
 105 for (int i = 0; i + 10 <= size; i++) {
107
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 102 times.
 105 if (!memcmp(buf + i, "CHAP", 4)) {
108 3 chap_pos = i;
109 3 printf("CHAP size bytes=%02x %02x %02x %02x\n",
110 3 buf[i + 4], buf[i + 5], buf[i + 6], buf[i + 7]);
111 3 break;
112 }
113 }
114
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
 3 if (readback(buf, size))
115 ✗ goto done;
116
117 /* A 224-byte title makes the CHAP payload 256 bytes. First test a valid
118 * synchsafe 256-byte CHAP (00 00 02 00, raw 512) followed by an empty
119 * TPE1 frame and a TALB frame inside the 300-byte padding area, so
120 * check_tag() must accept nlen == 0 at the 256-byte boundary rather than
121 * falling through to the raw 512-byte offset in zero padding. Then test
122 * the non-conforming plain size 00 00 01 00, whose high bits are clear
123 * so the synchsafe candidate at 128 bytes must be rejected by checking
124 * the oversized LLLL frame header inside the title. */
125
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 if (ambiguous) {
126
2/4
✓ Branch 0 taken 1 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
✗ Branch 3 not taken.
 1 if (chap_pos >= 0 && chap_pos + 10 + 256 + 45 + 27 <= size) {
127 uint8_t ch1_copy[45];
128 1 memcpy(ch1_copy, buf + chap_pos + 10 + 256, sizeof(ch1_copy));
129 1 memcpy(buf + chap_pos + 10 + 256, "TPE1\x00\x00\x00\x00\x00\x00", 10);
130 1 memcpy(buf + chap_pos + 10 + 266, "TALB\x00\x00\x00\x07\x00\x00\x03World", 17);
131 1 memcpy(buf + chap_pos + 10 + 283, ch1_copy, sizeof(ch1_copy));
132 1 printf("empty next frame version=4\n");
133
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
 1 if (readback(buf, size))
134 ✗ goto done;
135 1 memcpy(buf + chap_pos + 10 + 256, ch1_copy, sizeof(ch1_copy));
136 1 memset(buf + chap_pos + 10 + 301, 0, 27);
137
138 1 buf[chap_pos + 6] = 0x01;
139 1 buf[chap_pos + 7] = 0x00;
140 1 printf("ambiguous plain CHAP version=4\n");
141
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
 1 if (readback(buf, size))
142 ✗ goto done;
143 }
144 1 ret = 0;
145 1 goto done;
146 }
147
148 /* Non-conforming v2.4 CHAP with a plain 32-bit size (0x000000b6) whose
149 * high bit is set and whose payload contains uppercase ASCII at the
150 * stripped offset (0x36). Also zero the 4 size bytes after "LLLL" at
151 * offset 0x36 once to verify that is_syncsafe() rejects the 0x36
152 * candidate even when check_tag() would accept an empty frame header. */
153
3/4
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 1 times.
✗ Branch 3 not taken.
 2 if (version == 4 && chap_pos >= 0) {
154 uint8_t saved[4];
155 1 buf[chap_pos + 6] = 0x00;
156 1 buf[chap_pos + 7] = 0xb6;
157 1 printf("non-synchsafe CHAP version=4\n");
158
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
 1 if (readback(buf, size))
159 ✗ goto done;
160
161 1 memcpy(saved, buf + chap_pos + 10 + 0x36 + 4, sizeof(saved));
162 1 memset(buf + chap_pos + 10 + 0x36 + 4, 0, sizeof(saved));
163 1 printf("high-bit plain CHAP with fitting fake header version=4\n");
164
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
 1 if (readback(buf, size))
165 ✗ goto done;
166 1 memcpy(buf + chap_pos + 10 + 0x36 + 4, saved, sizeof(saved));
167 1 buf[chap_pos + 6] = 0x01;
168 1 buf[chap_pos + 7] = 0x36;
169 }
170
171 /* Split the 162-byte TIT2 subframe into a 22-byte TPE1 subframe with
172 * unread trailing bytes after its first NUL terminator, followed by a
173 * 140-byte TIT2 subframe, then test an oversized subframe length. */
174
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (chap_pos >= 0) {
175
1/2
✓ Branch 0 taken 42 times.
✗ Branch 1 not taken.
 42 for (int i = chap_pos + 10; i + 33 <= size; i++) {
176
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 40 times.
 42 if (!memcmp(buf + i, "TIT2", 4)) {
177 2 uint8_t enc = buf[i + 10];
178 2 memcpy(buf + i, "TPE1", 4);
179 2 buf[i + 6] = 0;
180 2 buf[i + 7] = 12;
181 2 buf[i + 13] = 0;
182 2 memcpy(buf + i + 22, "TIT2\x00\x00", 6);
183 2 buf[i + 28] = version == 4 ? 0x01 : 0x00;
184
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 1 times.
 2 buf[i + 29] = version == 4 ? 0x02 : 0x82;
185 2 buf[i + 30] = 0;
186 2 buf[i + 31] = 0;
187 2 buf[i + 32] = enc;
188 2 printf("trailing text subframe version=%d\n", version);
189
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (readback(buf, size))
190 ✗ goto done;
191
192 2 memcpy(buf + i, "TIT2", 4);
193 2 memset(buf + i + 4, 0x7f, 4);
194 2 printf("invalid subframe version=%d\n", version);
195
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (readback(buf, size))
196 ✗ goto done;
197 2 break;
198 }
199 }
200 }
201 2 ret = 0;
202
203 3 done:
204 3 ffio_free_dyn_buf(&pb);
205 3 av_free(buf);
206 3 avformat_free_context(out);
207 3 return ret;
208 }
209
210 1 int main(void)
211 {
212 1 int ret = roundtrip(3, 0);
213
214 1 ret |= roundtrip(4, 0);
215 1 ret |= roundtrip(4, 1);
216 1 return ret;
217 }
218