[FFmpeg-devel] [PATCH] avformat/mpegts: Check the next sync byte to avoid incorrectt detected raw packet size

[Marton Balint]

On Fri, 15 May 2020, lance.lmwang at gmail.com wrote:

> On Fri, May 15, 2020 at 08:02:44PM +0800, mypopy at gmail.com wrote:
>> On Fri, May 15, 2020 at 6:23 PM <lance.lmwang at gmail.com> wrote:
>> >
>> > From: Limin Wang <lance.lmwang at gmail.com>
>> >
>> > reanalyze() may misdetect the new packet size as 204, but it's 188 still actualy,
>> > it'll cause many cc errors report and cannot be recovered. So it's better to check
>> > the next sync byte before skip the extra unused bytes.
>> >
>> > Also, it is best to change SIZE_STAT_THRESHOLD from 10 to 100? If the input stream has
>> > a master/slave switch serveral times, the raw size can be easily detected by mistake.
>> >
>> > Signed-off-by: Limin Wang <lance.lmwang at gmail.com>
>> > ---
>> >  libavformat/mpegts.c | 13 +++++++------
>> >  1 file changed, 7 insertions(+), 6 deletions(-)
>> >
>> > diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
>> > index 0833d62..049555c 100644
>> > --- a/libavformat/mpegts.c
>> > +++ b/libavformat/mpegts.c
>> > @@ -2932,11 +2932,12 @@ static int read_packet(AVFormatContext *s, uint8_t *buf, int raw_packet_size,
>> >      return 0;
>> >  }
>> >
>> > -static void finished_reading_packet(AVFormatContext *s, int raw_packet_size)
>> > +static void finished_reading_packet(AVFormatContext *s, const uint8_t *data, int raw_packet_size)
>> >  {
>> >      AVIOContext *pb = s->pb;
>> >      int skip = raw_packet_size - TS_PACKET_SIZE;
>> > -    if (skip > 0)
>> > +    /* Check the next sync byte to avoid incorrectt detected raw packet size */
>> > +    if (skip > 0 && data[TS_PACKET_SIZE] != 0x47)
>> >          avio_skip(pb, skip);
>> >  }
>> >
>> > @@ -2985,7 +2986,7 @@ static int handle_packets(MpegTSContext *ts, int64_t nb_packets)
>> >          if (ret != 0)
>> >              break;
>> >          ret = handle_packet(ts, data, avio_tell(s->pb));
>> > -        finished_reading_packet(s, ts->raw_packet_size);
>> > +        finished_reading_packet(s, data, ts->raw_packet_size);
>> >          if (ret != 0)
>> >              break;
>> >      }
>> > @@ -3137,7 +3138,7 @@ static int mpegts_read_header(AVFormatContext *s)
>> >              pid = AV_RB16(data + 1) & 0x1fff;
>> >              if ((pcr_pid == -1 || pcr_pid == pid) &&
>> >                  parse_pcr(&pcr_h, &pcr_l, data) == 0) {
>> > -                finished_reading_packet(s, ts->raw_packet_size);
>> > +                finished_reading_packet(s, data, ts->raw_packet_size);
>> >                  pcr_pid = pid;
>> >                  packet_count[nb_pcrs] = nb_packets;
>> >                  pcrs[nb_pcrs] = pcr_h * 300 + pcr_l;
>> > @@ -3154,7 +3155,7 @@ static int mpegts_read_header(AVFormatContext *s)
>> >                      }
>> >                  }
>> >              } else {
>> > -                finished_reading_packet(s, ts->raw_packet_size);
>> > +                finished_reading_packet(s, data, ts->raw_packet_size);
>> >              }
>> >              nb_packets++;
>> >          }
>> > @@ -3194,7 +3195,7 @@ static int mpegts_raw_read_packet(AVFormatContext *s, AVPacket *pkt)
>> >      }
>> >      if (data != pkt->data)
>> >          memcpy(pkt->data, data, ts->raw_packet_size);
>> > -    finished_reading_packet(s, ts->raw_packet_size);
>> > +    finished_reading_packet(s, data, ts->raw_packet_size);
>> >      if (ts->mpeg2ts_compute_pcr) {
>> >          /* compute exact PCR for each packet */
>> >          if (parse_pcr(&pcr_h, &pcr_l, pkt->data) == 0) {
>> > --
>> > 1.8.3.1
>> >
>> Do you have a case to reproduce the cc errors report?
>
> Yes, it's real case which can be reproduced in lab.

Can you share the sample?

Thanks,
Marton