[deb_ffmpeg.git] / ffmpeg / libavformat / apngdec.c

/*
 * APNG demuxer
 * Copyright (c) 2014 Benoit Fouet
 *
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

/**
 * @file
 * APNG demuxer.
 * @see https://wiki.mozilla.org/APNG_Specification
 * @see http://www.w3.org/TR/PNG
 */

#include "avformat.h"
#include "avio_internal.h"
#include "internal.h"
#include "libavutil/imgutils.h"
#include "libavutil/intreadwrite.h"
#include "libavutil/opt.h"
#include "libavcodec/apng.h"
#include "libavcodec/png.h"
#include "libavcodec/bytestream.h"

#define DEFAULT_APNG_FPS 15

typedef struct APNGDemuxContext {
    const AVClass *class;

    int max_fps;
    int default_fps;

    int64_t pkt_pts;
    int pkt_duration;

    int is_key_frame;

    /*
     * loop options
     */
    int ignore_loop;
    uint32_t num_frames;
    uint32_t num_play;
    uint32_t cur_loop;
} APNGDemuxContext;

/*
 * To be a valid APNG file, we mandate, in this order:
 *     PNGSIG
 *     IHDR
 *     ...
 *     acTL
 *     ...
 *     IDAT
 */
static int apng_probe(AVProbeData *p)
{
    GetByteContext gb;
    int state = 0;
    uint32_t len, tag;

    bytestream2_init(&gb, p->buf, p->buf_size);

    if (bytestream2_get_be64(&gb) != PNGSIG)
        return 0;

    for (;;) {
        len = bytestream2_get_be32(&gb);
        if (len > 0x7fffffff)
            return 0;

        tag = bytestream2_get_le32(&gb);
        /* we don't check IDAT size, as this is the last tag
         * we check, and it may be larger than the probe buffer */
        if (tag != MKTAG('I', 'D', 'A', 'T') &&
            len + 4 > bytestream2_get_bytes_left(&gb))
            return 0;

        switch (tag) {
        case MKTAG('I', 'H', 'D', 'R'):
            if (len != 13)
                return 0;
            if (av_image_check_size(bytestream2_get_be32(&gb), bytestream2_get_be32(&gb), 0, NULL))
                return 0;
            bytestream2_skip(&gb, 9);
            state++;
            break;
        case MKTAG('a', 'c', 'T', 'L'):
            if (state != 1 ||
                len != 8 ||
                bytestream2_get_be32(&gb) == 0) /* 0 is not a valid value for number of frames */
                return 0;
            bytestream2_skip(&gb, 8);
            state++;
            break;
        case MKTAG('I', 'D', 'A', 'T'):
            if (state != 2)
                return 0;
            goto end;
        default:
            /* skip other tags */
            bytestream2_skip(&gb, len + 4);
            break;
        }
    }

end:
    return AVPROBE_SCORE_MAX;
}

static int append_extradata(AVCodecContext *s, AVIOContext *pb, int len)
{
    int previous_size = s->extradata_size;
    int new_size, ret;
    uint8_t *new_extradata;

    if (previous_size > INT_MAX - len)
        return AVERROR_INVALIDDATA;

    new_size = previous_size + len;
    new_extradata = av_realloc(s->extradata, new_size + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!new_extradata)
        return AVERROR(ENOMEM);
    s->extradata = new_extradata;
    s->extradata_size = new_size;

    if ((ret = avio_read(pb, s->extradata + previous_size, len)) < 0)
        return ret;

    return previous_size;
}

static int apng_read_header(AVFormatContext *s)
{
    APNGDemuxContext *ctx = s->priv_data;
    AVIOContext *pb = s->pb;
    uint32_t len, tag;
    AVStream *st;
    int ret = AVERROR_INVALIDDATA, acTL_found = 0;

    /* verify PNGSIG */
    if (avio_rb64(pb) != PNGSIG)
        return ret;

    /* parse IHDR (must be first chunk) */
    len = avio_rb32(pb);
    tag = avio_rl32(pb);
    if (len != 13 || tag != MKTAG('I', 'H', 'D', 'R'))
        return ret;

    st = avformat_new_stream(s, NULL);
    if (!st)
        return AVERROR(ENOMEM);

    /* set the timebase to something large enough (1/100,000 of second)
     * to hopefully cope with all sane frame durations */
    avpriv_set_pts_info(st, 64, 1, 100000);
    st->codec->codec_type = AVMEDIA_TYPE_VIDEO;
    st->codec->codec_id   = AV_CODEC_ID_APNG;
    st->codec->width      = avio_rb32(pb);
    st->codec->height     = avio_rb32(pb);
    if ((ret = av_image_check_size(st->codec->width, st->codec->height, 0, s)) < 0)
        return ret;

    /* extradata will contain every chunk up to the first fcTL (excluded) */
    st->codec->extradata = av_malloc(len + 12 + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!st->codec->extradata)
        return AVERROR(ENOMEM);
    st->codec->extradata_size = len + 12;
    AV_WB32(st->codec->extradata,    len);
    AV_WL32(st->codec->extradata+4,  tag);
    AV_WB32(st->codec->extradata+8,  st->codec->width);
    AV_WB32(st->codec->extradata+12, st->codec->height);
    if ((ret = avio_read(pb, st->codec->extradata+16, 9)) < 0)
        goto fail;

    while (!avio_feof(pb)) {
        if (acTL_found && ctx->num_play != 1) {
            int64_t size   = avio_size(pb);
            int64_t offset = avio_tell(pb);
            if (size < 0) {
                ret = size;
                goto fail;
            } else if (offset < 0) {
                ret = offset;
                goto fail;
            } else if ((ret = ffio_ensure_seekback(pb, size - offset)) < 0) {
                av_log(s, AV_LOG_WARNING, "Could not ensure seekback, will not loop\n");
                ctx->num_play = 1;
            }
        }
        if ((ctx->num_play == 1 || !acTL_found) &&
            ((ret = ffio_ensure_seekback(pb, 4 /* len */ + 4 /* tag */)) < 0))
            goto fail;

        len = avio_rb32(pb);
        if (len > 0x7fffffff) {
            ret = AVERROR_INVALIDDATA;
            goto fail;
        }

        tag = avio_rl32(pb);
        switch (tag) {
        case MKTAG('a', 'c', 'T', 'L'):
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = append_extradata(st->codec, pb, len + 12)) < 0)
                goto fail;
            acTL_found = 1;
            ctx->num_frames = AV_RB32(st->codec->extradata + ret + 8);
            ctx->num_play   = AV_RB32(st->codec->extradata + ret + 12);
            av_log(s, AV_LOG_DEBUG, "num_frames: %"PRIu32", num_play: %"PRIu32"\n",
                                    ctx->num_frames, ctx->num_play);
            break;
        case MKTAG('f', 'c', 'T', 'L'):
            if (!acTL_found) {
               ret = AVERROR_INVALIDDATA;
               goto fail;
            }
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
                goto fail;
            return 0;
        default:
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = append_extradata(st->codec, pb, len + 12)) < 0)
                goto fail;
        }
    }

fail:
    if (st->codec->extradata_size) {
        av_freep(&st->codec->extradata);
        st->codec->extradata_size = 0;
    }
    return ret;
}

static int decode_fctl_chunk(AVFormatContext *s, APNGDemuxContext *ctx, AVPacket *pkt)
{
    uint32_t sequence_number, width, height, x_offset, y_offset;
    uint16_t delay_num, delay_den;
    uint8_t dispose_op, blend_op;

    sequence_number = avio_rb32(s->pb);
    width           = avio_rb32(s->pb);
    height          = avio_rb32(s->pb);
    x_offset        = avio_rb32(s->pb);
    y_offset        = avio_rb32(s->pb);
    delay_num       = avio_rb16(s->pb);
    delay_den       = avio_rb16(s->pb);
    dispose_op      = avio_r8(s->pb);
    blend_op        = avio_r8(s->pb);
    avio_skip(s->pb, 4); /* crc */

    /* default is hundredths of seconds */
    if (!delay_den)
        delay_den = 100;
    if (!delay_num || delay_den / delay_num > ctx->max_fps) {
        delay_num = 1;
        delay_den = ctx->default_fps;
    }
    ctx->pkt_duration = av_rescale_q(delay_num,
                                     (AVRational){ 1, delay_den },
                                     s->streams[0]->time_base);

    av_log(s, AV_LOG_DEBUG, "%s: "
            "sequence_number: %"PRId32", "
            "width: %"PRIu32", "
            "height: %"PRIu32", "
            "x_offset: %"PRIu32", "
            "y_offset: %"PRIu32", "
            "delay_num: %"PRIu16", "
            "delay_den: %"PRIu16", "
            "dispose_op: %d, "
            "blend_op: %d\n",
            __FUNCTION__,
            sequence_number,
            width,
            height,
            x_offset,
            y_offset,
            delay_num,
            delay_den,
            dispose_op,
            blend_op);

    if (width != s->streams[0]->codec->width ||
        height != s->streams[0]->codec->height ||
        x_offset != 0 ||
        y_offset != 0) {
        if (sequence_number == 0 ||
            x_offset >= s->streams[0]->codec->width ||
            width > s->streams[0]->codec->width - x_offset ||
            y_offset >= s->streams[0]->codec->height ||
            height > s->streams[0]->codec->height - y_offset)
            return AVERROR_INVALIDDATA;
        ctx->is_key_frame = 0;
    } else {
        if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS)
            dispose_op = APNG_DISPOSE_OP_BACKGROUND;
        ctx->is_key_frame = dispose_op == APNG_DISPOSE_OP_BACKGROUND ||
                            blend_op   == APNG_BLEND_OP_SOURCE;
    }

    return 0;
}

static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
{
    APNGDemuxContext *ctx = s->priv_data;
    int ret;
    int64_t size;
    AVIOContext *pb = s->pb;
    uint32_t len, tag;

    /*
     * fcTL chunk length, in bytes:
     *  4 (length)
     *  4 (tag)
     * 26 (actual chunk)
     *  4 (crc) bytes
     * and needed next:
     *  4 (length)
     *  4 (tag (must be fdAT or IDAT))
     */
    /* if num_play is not 1, then the seekback is already guaranteed */
    if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 46)) < 0)
        return ret;

    len = avio_rb32(pb);
    tag = avio_rl32(pb);
    switch (tag) {
    case MKTAG('f', 'c', 'T', 'L'):
        if (len != 26)
            return AVERROR_INVALIDDATA;

        if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
            return ret;

        /* fcTL must precede fdAT or IDAT */
        len = avio_rb32(pb);
        tag = avio_rl32(pb);
        if (len > 0x7fffffff ||
            tag != MKTAG('f', 'd', 'A', 'T') &&
            tag != MKTAG('I', 'D', 'A', 'T'))
            return AVERROR_INVALIDDATA;

        size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;
        if (size > INT_MAX)
            return AVERROR(EINVAL);

        if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 ||
            (ret = av_append_packet(pb, pkt, size)) < 0)
            return ret;

        if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
            return ret;

        len = avio_rb32(pb);
        tag = avio_rl32(pb);
        while (tag &&
               tag != MKTAG('f', 'c', 'T', 'L') &&
               tag != MKTAG('I', 'E', 'N', 'D')) {
            if (len > 0x7fffffff)
                return AVERROR_INVALIDDATA;
            if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 ||
                (ret = av_append_packet(pb, pkt, len + 12)) < 0)
                return ret;
            if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
                return ret;
            len = avio_rb32(pb);
            tag = avio_rl32(pb);
        }
        if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
            return ret;

        if (ctx->is_key_frame)
            pkt->flags |= AV_PKT_FLAG_KEY;
        pkt->pts = ctx->pkt_pts;
        pkt->duration = ctx->pkt_duration;
        ctx->pkt_pts += ctx->pkt_duration;
        return ret;
    case MKTAG('I', 'E', 'N', 'D'):
        ctx->cur_loop++;
        if (ctx->ignore_loop || ctx->num_play >= 1 && ctx->cur_loop == ctx->num_play) {
            avio_seek(pb, -8, SEEK_CUR);
            return AVERROR_EOF;
        }
        if ((ret = avio_seek(pb, s->streams[0]->codec->extradata_size + 8, SEEK_SET)) < 0)
            return ret;
        return 0;
    default:
        {
        char tag_buf[5];

        av_get_codec_tag_string(tag_buf, sizeof(tag_buf), tag);
        avpriv_request_sample(s, "In-stream tag=%s (0x%08X) len=%"PRIu32, tag_buf, tag, len);
        avio_skip(pb, len + 4);
        }
    }

    /* Handle the unsupported yet cases */
    return AVERROR_PATCHWELCOME;
}

static const AVOption options[] = {
    { "ignore_loop", "ignore loop setting"                         , offsetof(APNGDemuxContext, ignore_loop),
      AV_OPT_TYPE_INT, { .i64 = 1 }               , 0, 1      , AV_OPT_FLAG_DECODING_PARAM },
    { "max_fps"    , "maximum framerate (0 is no limit)"           , offsetof(APNGDemuxContext, max_fps),
      AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
    { "default_fps", "default framerate (0 is as fast as possible)", offsetof(APNGDemuxContext, default_fps),
      AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
    { NULL },
};

static const AVClass demuxer_class = {
    .class_name = "APNG demuxer",
    .item_name  = av_default_item_name,
    .option     = options,
    .version    = LIBAVUTIL_VERSION_INT,
    .category   = AV_CLASS_CATEGORY_DEMUXER,
};

AVInputFormat ff_apng_demuxer = {
    .name           = "apng",
    .long_name      = NULL_IF_CONFIG_SMALL("Animated Portable Network Graphics"),
    .priv_data_size = sizeof(APNGDemuxContext),
    .read_probe     = apng_probe,
    .read_header    = apng_read_header,
    .read_packet    = apng_read_packet,
    .flags          = AVFMT_GENERIC_INDEX,
    .priv_class     = &demuxer_class,
};
Commit	Line	Data
f6fa7814 DM	1	/*
	2	* APNG demuxer
	3	* Copyright (c) 2014 Benoit Fouet
	4	*
	5	* This file is part of FFmpeg.
	6	*
	7	* FFmpeg is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU Lesser General Public
	9	* License as published by the Free Software Foundation; either
	10	* version 2.1 of the License, or (at your option) any later version.
	11	*
	12	* FFmpeg is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	* Lesser General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU Lesser General Public
	18	* License along with FFmpeg; if not, write to the Free Software
	19	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
	20	*/
	21
	22	/**
	23	* @file
	24	* APNG demuxer.
	25	* @see https://wiki.mozilla.org/APNG_Specification
	26	* @see http://www.w3.org/TR/PNG
	27	*/
	28
	29	#include "avformat.h"
	30	#include "avio_internal.h"
	31	#include "internal.h"
	32	#include "libavutil/imgutils.h"
	33	#include "libavutil/intreadwrite.h"
	34	#include "libavutil/opt.h"
	35	#include "libavcodec/apng.h"
	36	#include "libavcodec/png.h"
	37	#include "libavcodec/bytestream.h"
	38
	39	#define DEFAULT_APNG_FPS 15
	40
	41	typedef struct APNGDemuxContext {
	42	const AVClass *class;
	43
	44	int max_fps;
	45	int default_fps;
	46
	47	int64_t pkt_pts;
	48	int pkt_duration;
	49
	50	int is_key_frame;
	51
	52	/*
	53	* loop options
	54	*/
	55	int ignore_loop;
	56	uint32_t num_frames;
	57	uint32_t num_play;
	58	uint32_t cur_loop;
	59	} APNGDemuxContext;
	60
	61	/*
	62	* To be a valid APNG file, we mandate, in this order:
	63	* PNGSIG
	64	* IHDR
65	* ...
66	* acTL
67	* ...
68	* IDAT
69	*/
70	static int apng_probe(AVProbeData *p)
71	{
72	GetByteContext gb;
73	int state = 0;
74	uint32_t len, tag;
75
76	bytestream2_init(&gb, p->buf, p->buf_size);
77
78	if (bytestream2_get_be64(&gb) != PNGSIG)
79	return 0;
80
81	for (;;) {
82	len = bytestream2_get_be32(&gb);
83	if (len > 0x7fffffff)
84	return 0;
85
86	tag = bytestream2_get_le32(&gb);
87	/* we don't check IDAT size, as this is the last tag
88	* we check, and it may be larger than the probe buffer */
89	if (tag != MKTAG('I', 'D', 'A', 'T') &&
90	len + 4 > bytestream2_get_bytes_left(&gb))
91	return 0;
92
93	switch (tag) {
94	case MKTAG('I', 'H', 'D', 'R'):
95	if (len != 13)
96	return 0;
97	if (av_image_check_size(bytestream2_get_be32(&gb), bytestream2_get_be32(&gb), 0, NULL))
98	return 0;
99	bytestream2_skip(&gb, 9);
100	state++;
101	break;
102	case MKTAG('a', 'c', 'T', 'L'):
103	if (state != 1 \|\|
104	len != 8 \|\|
105	bytestream2_get_be32(&gb) == 0) /* 0 is not a valid value for number of frames */
106	return 0;
107	bytestream2_skip(&gb, 8);
108	state++;
109	break;
110	case MKTAG('I', 'D', 'A', 'T'):
111	if (state != 2)
112	return 0;
113	goto end;
114	default:
115	/* skip other tags */
116	bytestream2_skip(&gb, len + 4);
117	break;
118	}
119	}
120
121	end:
122	return AVPROBE_SCORE_MAX;
123	}
124
125	static int append_extradata(AVCodecContext s, AVIOContext pb, int len)
126	{
127	int previous_size = s->extradata_size;
128	int new_size, ret;
129	uint8_t *new_extradata;
130
131	if (previous_size > INT_MAX - len)
132	return AVERROR_INVALIDDATA;
133
134	new_size = previous_size + len;
135	new_extradata = av_realloc(s->extradata, new_size + FF_INPUT_BUFFER_PADDING_SIZE);
136	if (!new_extradata)
137	return AVERROR(ENOMEM);
138	s->extradata = new_extradata;
139	s->extradata_size = new_size;
140
141	if ((ret = avio_read(pb, s->extradata + previous_size, len)) < 0)
142	return ret;
143
144	return previous_size;
145	}
146
147	static int apng_read_header(AVFormatContext *s)
148	{
149	APNGDemuxContext *ctx = s->priv_data;
150	AVIOContext *pb = s->pb;
151	uint32_t len, tag;
152	AVStream *st;
153	int ret = AVERROR_INVALIDDATA, acTL_found = 0;
154
155	/* verify PNGSIG */
156	if (avio_rb64(pb) != PNGSIG)
157	return ret;
158
159	/* parse IHDR (must be first chunk) */
160	len = avio_rb32(pb);
161	tag = avio_rl32(pb);
162	if (len != 13 \|\| tag != MKTAG('I', 'H', 'D', 'R'))
163	return ret;
164
165	st = avformat_new_stream(s, NULL);
166	if (!st)
167	return AVERROR(ENOMEM);
168
169	/* set the timebase to something large enough (1/100,000 of second)
170	* to hopefully cope with all sane frame durations */
171	avpriv_set_pts_info(st, 64, 1, 100000);
172	st->codec->codec_type = AVMEDIA_TYPE_VIDEO;
173	st->codec->codec_id = AV_CODEC_ID_APNG;
174	st->codec->width = avio_rb32(pb);
175	st->codec->height = avio_rb32(pb);
176	if ((ret = av_image_check_size(st->codec->width, st->codec->height, 0, s)) < 0)
177	return ret;
178
179	/* extradata will contain every chunk up to the first fcTL (excluded) */
180	st->codec->extradata = av_malloc(len + 12 + FF_INPUT_BUFFER_PADDING_SIZE);
181	if (!st->codec->extradata)
182	return AVERROR(ENOMEM);
183	st->codec->extradata_size = len + 12;
184	AV_WB32(st->codec->extradata, len);
185	AV_WL32(st->codec->extradata+4, tag);
186	AV_WB32(st->codec->extradata+8, st->codec->width);
187	AV_WB32(st->codec->extradata+12, st->codec->height);
188	if ((ret = avio_read(pb, st->codec->extradata+16, 9)) < 0)
189	goto fail;
190
191	while (!avio_feof(pb)) {
192	if (acTL_found && ctx->num_play != 1) {
193	int64_t size = avio_size(pb);
194	int64_t offset = avio_tell(pb);
195	if (size < 0) {
196	ret = size;
197	goto fail;
198	} else if (offset < 0) {
199	ret = offset;
200	goto fail;
201	} else if ((ret = ffio_ensure_seekback(pb, size - offset)) < 0) {
202	av_log(s, AV_LOG_WARNING, "Could not ensure seekback, will not loop\n");
203	ctx->num_play = 1;
204	}
205	}
206	if ((ctx->num_play == 1 \|\| !acTL_found) &&
207	((ret = ffio_ensure_seekback(pb, 4 /* len / + 4 / tag */)) < 0))
208	goto fail;
209
210	len = avio_rb32(pb);
211	if (len > 0x7fffffff) {
212	ret = AVERROR_INVALIDDATA;
213	goto fail;
214	}
215
216	tag = avio_rl32(pb);
217	switch (tag) {
218	case MKTAG('a', 'c', 'T', 'L'):
219	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
220	(ret = append_extradata(st->codec, pb, len + 12)) < 0)
221	goto fail;
222	acTL_found = 1;
223	ctx->num_frames = AV_RB32(st->codec->extradata + ret + 8);
224	ctx->num_play = AV_RB32(st->codec->extradata + ret + 12);
225	av_log(s, AV_LOG_DEBUG, "num_frames: %"PRIu32", num_play: %"PRIu32"\n",
226	ctx->num_frames, ctx->num_play);
227	break;
228	case MKTAG('f', 'c', 'T', 'L'):
229	if (!acTL_found) {
230	ret = AVERROR_INVALIDDATA;
231	goto fail;
232	}
233	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
234	goto fail;
235	return 0;
236	default:
237	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
238	(ret = append_extradata(st->codec, pb, len + 12)) < 0)
239	goto fail;
240	}
241	}
242
243	fail:
244	if (st->codec->extradata_size) {
245	av_freep(&st->codec->extradata);
246	st->codec->extradata_size = 0;
247	}
248	return ret;
249	}
250
251	static int decode_fctl_chunk(AVFormatContext s, APNGDemuxContext ctx, AVPacket *pkt)
252	{
253	uint32_t sequence_number, width, height, x_offset, y_offset;
254	uint16_t delay_num, delay_den;
255	uint8_t dispose_op, blend_op;
256
257	sequence_number = avio_rb32(s->pb);
258	width = avio_rb32(s->pb);
259	height = avio_rb32(s->pb);
260	x_offset = avio_rb32(s->pb);
261	y_offset = avio_rb32(s->pb);
262	delay_num = avio_rb16(s->pb);
263	delay_den = avio_rb16(s->pb);
264	dispose_op = avio_r8(s->pb);
265	blend_op = avio_r8(s->pb);
266	avio_skip(s->pb, 4); /* crc */
267
268	/* default is hundredths of seconds */
269	if (!delay_den)
270	delay_den = 100;
271	if (!delay_num \|\| delay_den / delay_num > ctx->max_fps) {
272	delay_num = 1;
273	delay_den = ctx->default_fps;
274	}
275	ctx->pkt_duration = av_rescale_q(delay_num,
276	(AVRational){ 1, delay_den },
277	s->streams[0]->time_base);
278
279	av_log(s, AV_LOG_DEBUG, "%s: "
280	"sequence_number: %"PRId32", "
281	"width: %"PRIu32", "
282	"height: %"PRIu32", "
283	"x_offset: %"PRIu32", "
284	"y_offset: %"PRIu32", "
285	"delay_num: %"PRIu16", "
286	"delay_den: %"PRIu16", "
287	"dispose_op: %d, "
288	"blend_op: %d\n",
289	__FUNCTION__,
290	sequence_number,
291	width,
292	height,
293	x_offset,
294	y_offset,
295	delay_num,
296	delay_den,
297	dispose_op,
298	blend_op);
299
300	if (width != s->streams[0]->codec->width \|\|
301	height != s->streams[0]->codec->height \|\|
302	x_offset != 0 \|\|
303	y_offset != 0) {
304	if (sequence_number == 0 \|\|
305	x_offset >= s->streams[0]->codec->width \|\|
306	width > s->streams[0]->codec->width - x_offset \|\|
307	y_offset >= s->streams[0]->codec->height \|\|
308	height > s->streams[0]->codec->height - y_offset)
309	return AVERROR_INVALIDDATA;
310	ctx->is_key_frame = 0;
311	} else {
312	if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS)
313	dispose_op = APNG_DISPOSE_OP_BACKGROUND;
314	ctx->is_key_frame = dispose_op == APNG_DISPOSE_OP_BACKGROUND \|\|
315	blend_op == APNG_BLEND_OP_SOURCE;
316	}
317
318	return 0;
319	}
320
321	static int apng_read_packet(AVFormatContext s, AVPacket pkt)
322	{
323	APNGDemuxContext *ctx = s->priv_data;
324	int ret;
325	int64_t size;
326	AVIOContext *pb = s->pb;
327	uint32_t len, tag;
328
329	/*
330	* fcTL chunk length, in bytes:
331	* 4 (length)
332	* 4 (tag)
333	* 26 (actual chunk)
334	* 4 (crc) bytes
335	* and needed next:
336	* 4 (length)
337	* 4 (tag (must be fdAT or IDAT))
338	*/
339	/* if num_play is not 1, then the seekback is already guaranteed */
340	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 46)) < 0)
341	return ret;
342
343	len = avio_rb32(pb);
344	tag = avio_rl32(pb);
345	switch (tag) {
346	case MKTAG('f', 'c', 'T', 'L'):
347	if (len != 26)
348	return AVERROR_INVALIDDATA;
349
350	if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
351	return ret;
352
353	/* fcTL must precede fdAT or IDAT */
354	len = avio_rb32(pb);
355	tag = avio_rl32(pb);
356	if (len > 0x7fffffff \|\|
357	tag != MKTAG('f', 'd', 'A', 'T') &&
358	tag != MKTAG('I', 'D', 'A', 'T'))
359	return AVERROR_INVALIDDATA;
360
361	size = 38 /* fcTL / + 8 / len, tag / + len + 4 / crc */;
362	if (size > INT_MAX)
363	return AVERROR(EINVAL);
364
365	if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 \|\|
366	(ret = av_append_packet(pb, pkt, size)) < 0)
367	return ret;
368
369	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
370	return ret;
371
372	len = avio_rb32(pb);
373	tag = avio_rl32(pb);
374	while (tag &&
375	tag != MKTAG('f', 'c', 'T', 'L') &&
376	tag != MKTAG('I', 'E', 'N', 'D')) {
377	if (len > 0x7fffffff)
378	return AVERROR_INVALIDDATA;
379	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 \|\|
380	(ret = av_append_packet(pb, pkt, len + 12)) < 0)
381	return ret;
382	if (ctx->num_play == 1 && (ret = ffio_ensure_seekback(pb, 8)) < 0)
383	return ret;
384	len = avio_rb32(pb);
385	tag = avio_rl32(pb);
386	}
387	if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0)
388	return ret;
389
390	if (ctx->is_key_frame)
391	pkt->flags \|= AV_PKT_FLAG_KEY;
392	pkt->pts = ctx->pkt_pts;
393	pkt->duration = ctx->pkt_duration;
394	ctx->pkt_pts += ctx->pkt_duration;
395	return ret;
396	case MKTAG('I', 'E', 'N', 'D'):
397	ctx->cur_loop++;
398	if (ctx->ignore_loop \|\| ctx->num_play >= 1 && ctx->cur_loop == ctx->num_play) {
399	avio_seek(pb, -8, SEEK_CUR);
400	return AVERROR_EOF;
401	}
402	if ((ret = avio_seek(pb, s->streams[0]->codec->extradata_size + 8, SEEK_SET)) < 0)
403	return ret;
404	return 0;
405	default:
406	{
407	char tag_buf[5];
408
409	av_get_codec_tag_string(tag_buf, sizeof(tag_buf), tag);
410	avpriv_request_sample(s, "In-stream tag=%s (0x%08X) len=%"PRIu32, tag_buf, tag, len);
411	avio_skip(pb, len + 4);
412	}
413	}
414
415	/* Handle the unsupported yet cases */
416	return AVERROR_PATCHWELCOME;
417	}
418
419	static const AVOption options[] = {
420	{ "ignore_loop", "ignore loop setting" , offsetof(APNGDemuxContext, ignore_loop),
421	AV_OPT_TYPE_INT, { .i64 = 1 } , 0, 1 , AV_OPT_FLAG_DECODING_PARAM },
422	{ "max_fps" , "maximum framerate (0 is no limit)" , offsetof(APNGDemuxContext, max_fps),
423	AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
424	{ "default_fps", "default framerate (0 is as fast as possible)", offsetof(APNGDemuxContext, default_fps),
425	AV_OPT_TYPE_INT, { .i64 = DEFAULT_APNG_FPS }, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
426	{ NULL },
427	};
428
429	static const AVClass demuxer_class = {
430	.class_name = "APNG demuxer",
431	.item_name = av_default_item_name,
432	.option = options,
433	.version = LIBAVUTIL_VERSION_INT,
434	.category = AV_CLASS_CATEGORY_DEMUXER,
435	};
436
437	AVInputFormat ff_apng_demuxer = {
438	.name = "apng",
439	.long_name = NULL_IF_CONFIG_SMALL("Animated Portable Network Graphics"),
440	.priv_data_size = sizeof(APNGDemuxContext),
441	.read_probe = apng_probe,
442	.read_header = apng_read_header,
443	.read_packet = apng_read_packet,
444	.flags = AVFMT_GENERIC_INDEX,
445	.priv_class = &demuxer_class,
446	};