[FFmpeg-devel] [PATCH] avformat/mov: Correctly read EIA608 packets if multiple boxes or non-field 1 data is present

[Sebastian Dröge]

From: Sebastian Dröge <sebastian at centricular.com>

The payload of EIA608 samples in MOV is one or more cdat or cdt2 boxes.
cdat contains EIA608 byte pairs for field 1, cdt2 for field 2.

Previously any box following the first was treated as EIA608 byte pairs
instead of parsing them correctly, and all data was handled as field 1.
---
 libavformat/mov.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9fdeef057e..edd14701bf 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8868,22 +8868,40 @@ static int mov_change_extradata(MOVStreamContext *sc, AVPacket *pkt)
 
 static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
 {
-    int new_size, ret;
+    const uint32_t cdat_fourcc = AV_RL32("cdat");
+    const uint32_t cdt2_fourcc = AV_RL32("cdt2");
+    int new_size, write_size, ret;
 
     if (size <= 8)
         return AVERROR_INVALIDDATA;
+
     new_size = ((size - 8) / 2) * 3;
     ret = av_new_packet(pkt, new_size);
     if (ret < 0)
         return ret;
 
-    avio_skip(pb, 8);
-    for (int j = 0; j < new_size; j += 3) {
-        pkt->data[j] = 0xFC;
-        pkt->data[j+1] = avio_r8(pb);
-        pkt->data[j+2] = avio_r8(pb);
+    write_size = 0;
+    while (size > 8) {
+      uint32_t box_size = avio_rb32(pb);
+      uint32_t box_fourcc = avio_rl32(pb);
+
+      if (box_size <= 8 || (box_size & 1) != 0 || box_size > size)
+        return AVERROR_INVALIDDATA;
+      if (box_fourcc != cdat_fourcc && box_fourcc != cdt2_fourcc)
+        return AVERROR_INVALIDDATA;
+
+      for (int j = 8; j < box_size; j += 2) {
+          pkt->data[write_size] = box_fourcc == cdat_fourcc ? 0xFC : 0xFF;
+          pkt->data[write_size+1] = avio_r8(pb);
+          pkt->data[write_size+2] = avio_r8(pb);
+      }
+
+      write_size += box_size;
+      size -= box_size;
     }
 
+    av_shrink_packet(pkt, write_size);
+
     return 0;
 }
 
-- 
2.40.1