rtpdec_hevc: correct parsing of aggregated packets

reported by tim dot yao at amlogic dot com

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Thomas Volkert 2015-02-12 20:41:39 +01:00 committed by Michael Niedermayer
parent 1679d68dbf
commit b6f577dbb2

View File

@ -23,14 +23,17 @@
#include "libavutil/avassert.h"
#include "libavutil/avstring.h"
#include "libavutil/base64.h"
#include "libavcodec/get_bits.h"
#include "avformat.h"
#include "rtpdec.h"
#define RTP_HEVC_PAYLOAD_HEADER_SIZE 2
#define RTP_HEVC_FU_HEADER_SIZE 1
#define RTP_HEVC_DONL_FIELD_SIZE 2
#define HEVC_SPECIFIED_NAL_UNIT_TYPES 48
#define RTP_HEVC_PAYLOAD_HEADER_SIZE 2
#define RTP_HEVC_FU_HEADER_SIZE 1
#define RTP_HEVC_DONL_FIELD_SIZE 2
#define RTP_HEVC_DOND_FIELD_SIZE 1
#define RTP_HEVC_AP_NALU_LENGTH_FIELD_SIZE 2
#define HEVC_SPECIFIED_NAL_UNIT_TYPES 48
/* SDP out-of-band signaling data */
struct PayloadContext {
@ -317,19 +320,6 @@ static int hevc_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_hevc_ctx
}
switch (nal_type) {
/* aggregated packets (AP) */
case 48:
/* pass the HEVC payload header */
buf += RTP_HEVC_PAYLOAD_HEADER_SIZE;
len -= RTP_HEVC_PAYLOAD_HEADER_SIZE;
/* pass the HEVC DONL field */
if (rtp_hevc_ctx->using_donl_field) {
buf += RTP_HEVC_DONL_FIELD_SIZE;
len -= RTP_HEVC_DONL_FIELD_SIZE;
}
/* fall-through */
/* video parameter set (VPS) */
case 32:
/* sequence parameter set (SPS) */
@ -356,6 +346,73 @@ static int hevc_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_hevc_ctx
/* A/V packet: copy NAL unit data */
memcpy(pkt->data + sizeof(start_sequence), buf, len);
break;
/* aggregated packet (AP) - with two or more NAL units */
case 48:
/* pass the HEVC payload header */
buf += RTP_HEVC_PAYLOAD_HEADER_SIZE;
len -= RTP_HEVC_PAYLOAD_HEADER_SIZE;
/* pass the HEVC DONL field */
if (rtp_hevc_ctx->using_donl_field) {
buf += RTP_HEVC_DONL_FIELD_SIZE;
len -= RTP_HEVC_DONL_FIELD_SIZE;
}
/*
* pass 0: determine overall size of the A/V packet
* pass 1: create resulting A/V packet
*/
{
int pass = 0;
int pkt_size = 0;
uint8_t *pkt_data = 0;
for (pass = 0; pass < 2; pass++) {
const uint8_t *buf1 = buf;
int len1 = len;
while (len1 > RTP_HEVC_AP_NALU_LENGTH_FIELD_SIZE) {
uint16_t nalu_size = AV_RB16(buf1);
/* pass the NALU length field */
buf1 += RTP_HEVC_AP_NALU_LENGTH_FIELD_SIZE;
len1 -= RTP_HEVC_AP_NALU_LENGTH_FIELD_SIZE;
if (nalu_size > 0 && nalu_size <= len1) {
if (pass == 0) {
pkt_size += sizeof(start_sequence) + nalu_size;
} else {
/* A/V packet: copy start sequence */
memcpy(pkt_data, start_sequence, sizeof(start_sequence));
/* A/V packet: copy NAL unit data */
memcpy(pkt_data + sizeof(start_sequence), buf1, nalu_size);
/* shift pointer beyond the current NAL unit */
pkt_data += sizeof(start_sequence) + nalu_size;
}
}
/* pass the current NAL unit */
buf1 += nalu_size;
len1 -= nalu_size;
/* pass the HEVC DOND field */
if (rtp_hevc_ctx->using_donl_field) {
buf1 += RTP_HEVC_DOND_FIELD_SIZE;
len1 -= RTP_HEVC_DOND_FIELD_SIZE;
}
}
/* create A/V packet */
if (pass == 0) {
if ((res = av_new_packet(pkt, pkt_size)) < 0)
return res;
pkt_data = pkt->data;
}
}
}
break;
/* fragmentation unit (FU) */
case 49: